How do you extract a string from field _raw?

[mukesh2019]

Hi ,

I am trying to extract info from the _raw result of my Splunk query. Currently my _raw result is:

_raw="ServiceOperation=Hudson_RetrivePatientNot|Broker_HostName=CHELSEA|RequestDateTime=20190113T03:02:18.209400|MessageTranID=**8bfa95c4170911e9b1740a099a2b0000**|UserID=A123|AppID=AERO|ExecGrpName=xxxxxx|TimeStamp=2019-01-13T03:02:28.364605|Message="RetrievePatientFailure"|Detail="RetreivePatientNotes""

I would like to extract the MessageTranID, which in this case is '8bfa95c4-1709-11e9-b174-0a099a2b0000', from the above _raw string.

Something like : base search | regex

Can anyone help?

Thanks so much!

[vnravikumar]

Hi @mukesh2019

Please try this:

| rex field=_raw "MessageTranID\=(?P<MessageTranID>(.*))\|UserID\="

[gcusello · Accepted solution]

Hi mukesh2019,
try this regex:

\|MessageTranID\=(?<MessageTranID>[^\|]*)

You can test it at https://regex101.com/r/rsBith/1

Bye.
Giuseppe

[mukesh2019]

Thanks a lot.it works 🙂