How do I extract a substring beginning by some characters and ending by :

[proussinbnc]

Hi,

I have this in my message string:

Errors in file /u02/app/oracle/diag/rdbms/pwein1a/pwein1a1/trace/pwein1a1_cjq0_287471.trc: ORA-12850: Could not allocate slaves on all specified instances: needed, allocated

ORA-16401: archive log rejected by Remote File Server (RFS)

I would like to extract in a search only the substring: ORA-nnnnn

Any ideas, I tried every solution available here in the community. Bu I am fairly new to Splunk.

Thanks Pierre

[inventsekar · Accepted solution]

Hi, You can use rex command...

|makeresults | eval _raw="pwein1a1_cjq0_287471.trc: ORA-12850: Could not allocate" | rex field=_raw "(?<oraNum>ORA-\d+)\:" | table _raw oraNum

oraNum.png

if this solves your query, pls accept this as solution, upvote is appreciated, thanks. 

[proussinbnc]

Thanks a lot !