Splunk Search

How do I extract a substring beginning by some characters and ending by :

proussinbnc
Engager

Hi,

I have this in my message string:

Errors in file /u02/app/oracle/diag/rdbms/pwein1a/pwein1a1/trace/pwein1a1_cjq0_287471.trc: ORA-12850: Could not allocate slaves on all specified instances: needed, allocated

ORA-16401: archive log rejected by Remote File Server (RFS)

 

I would like to extract in a search only the substring: ORA-nnnnn

 

Any ideas, I tried every solution available here in the community. Bu I am fairly new to Splunk.

 

Thanks Pierre

Labels (1)
0 Karma
1 Solution

inventsekar
SplunkTrust
SplunkTrust

Hi, You can use rex command...

|makeresults | eval _raw="pwein1a1_cjq0_287471.trc: ORA-12850: Could not allocate" | rex field=_raw "(?<oraNum>ORA-\d+)\:" | table _raw oraNum

oraNum.png

if this solves your query, pls accept this as solution, upvote is appreciated, thanks. 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

View solution in original post

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi, You can use rex command...

|makeresults | eval _raw="pwein1a1_cjq0_287471.trc: ORA-12850: Could not allocate" | rex field=_raw "(?<oraNum>ORA-\d+)\:" | table _raw oraNum

oraNum.png

if this solves your query, pls accept this as solution, upvote is appreciated, thanks. 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

proussinbnc
Engager

Thanks a lot !

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...