How to extract desired data from search result?

[sneha03]

Hi Team,

We are trying below search:

index=index_123 host=xyz source="/sys_apps_01/pqr/logs/xyz/mapper_xyz.log" ContextKeyMatch: Context Field Value 

which gives below results with multiple rows as below:

Now we want to extract data after Context Filed Value. The string having "Context Filed Value" is of variable string length

We have multiple rows like above and we need to extract such data from each row. like : 005436213114023275.

Once we have the extracted data we need to fetch only  last 12 digits

Could you please suggest regarding this?

[ITWhisperer]

Try something like this

| rex "Context Field Value\s+\d*(?<value>\d{12})"

[PickleRick]

Ideally, you should have this defined as an automatically extracted field so you don't have to do it ad-hoc every time. But for a one-off extraction you can do it with the rex command. Something like this:

<your search>
| rex "Context Filed Value.*(?<my_field>\d{12})$"