Splunk Search

How to extract a field from raw using rex?

Explorer
SVSCPLEX,S0W1,S0W1.DAL-EBIS.IHOST.COM,SYSLOG,zOS-SYSLOG-Console,SYSLOG,-0400,NE,001C,19283 01.21.46.880
 -0500,S0W1    ,JOB03487,        ,40000000000000000000000000000000,00000090,TESCREAT,00," IEF450I TESCREAT STEP010 - ABEND=S222 U0000 REASON=00000000"\n

How to extract JOB03487 from this _raw? can anyone help?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi kavyamohan,
try this

| rex "([^7]*,){5}(?<job>[^,]*),"

you can test it at https://regex101.com/r/eW7oCi/1

Ciao.
Giuseppe

View solution in original post

SplunkTrust
SplunkTrust

Hi kavyamohan,
try this

| rex "([^7]*,){5}(?<job>[^,]*),"

you can test it at https://regex101.com/r/eW7oCi/1

Ciao.
Giuseppe

View solution in original post

Explorer

Thank you it worked

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!