Hello, I am new to splunk rex, need help for below to extract a value from string.
rex "Error while calling database for id = (?<id>.*)"
Example string: "Error while calling database for id =8748723874_1"
Output should be 8748723874
Thanks.
You didn't show the result or explain why the result is wrong. Do you mean you just want to get rid of the part after underscore _? Normally, Splunk should have given you a field id that contains value 8748723874_1. If so, always work from the smaller data. You do not need regex for this task. Just do
| eval id = mvindex(split(id, "_"), 1)
If Splunk doesn't give you this field, you can do
| rex "Error while calling database for id\s*=\s*(?<id>[^_]+)"
Hope this helps