How to extract field value with alphanumeric value with no exact length

[amit2312]

Hi All,

I am very new to splunk and faced a issue while extracting a value which is having alphanumeric value, with no predefined length. ex:

2025-05-15T04:32:12.397Z INFO 1 --- [nio-8080-exec-4] x.y.z.y.LDAPAccountServiceImpl : [Request END] Failed : Cannot fetch secret for Vault Engine - XYXR_VPN_Engine, AIT - 9876 Service ID - zywstrf

2025-05-15T04:32:12.397Z INFO 1 --- [nio-8080-exec-4] x.y.z.y.LDAPAccountServiceImpl : [Request END] Failed : Cannot fetch secret for Vault Engine - XYXR_VPN_Engine, AIT - 9876 Service ID - abc123f

2025-05-15T04:32:12.397Z INFO 1 --- [nio-8080-exec-4] x.y.z.y.LDAPAccountServiceImpl : [Request END] Failed : Cannot fetch secret for Vault Engine - XYXR_VPN_Engine, AIT - 9876 Service ID - 1234-abcehu09_svc06-app_texsas_14455

I am trying get the Service ID value, which comes at the end of the line.

Thanks a lot in advance.

Regards,

AKM

[livehybrid]

Hi @amit2312 

If you want to extract this as part of a search then you can do the following:

| rex "Service ID - (?<Service_ID>\S+)$"

For example: 

To convert your rex to an automatic extraction, add the regex as a REPORT extraction or inline FIELD extraction to your props.conf:

== props.conf ==
[yourSourcetype]REPORT-service_id = service_id_extraction  

== transforms.conf == 
[service_id_extraction]  
REGEX = Service ID - (?<Service_ID>\S+)$ 

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[amit2312]

Hi @livehybrid 

Thanks a lot for your quick response, the solution worked nicely.

Regards,

AKM

[isoutamo]

Hi

regex101.com is your friend, when you need to start with regex. Here is your example https://regex101.com/r/Tu8JB5/1

In splunk you have couple of ways to get this done.

• Use rex as @livehybrid shows and create that rex e.g. by regex101.com
• Use splunk

| makeresults 
| eval _raw ="2025-05-15T04:32:12.397Z INFO 1 --- [nio-8080-exec-4] x.y.z.y.LDAPAccountServiceImpl : [Request END] Failed : Cannot fetch secret for Vault Engine - XYXR_VPN_Engine, AIT - 9876 Service ID - zywstrf
2025-05-15T04:32:12.397Z INFO 1 --- [nio-8080-exec-4] x.y.z.y.LDAPAccountServiceImpl : [Request END] Failed : Cannot fetch secret for Vault Engine - XYXR_VPN_Engine, AIT - 9876 Service ID - abc123f
2025-05-15T04:32:12.397Z INFO 1 --- [nio-8080-exec-4] x.y.z.y.LDAPAccountServiceImpl : [Request END] Failed : Cannot fetch secret for Vault Engine - XYXR_VPN_Engine, AIT - 9876 Service ID - 1234-abcehu09_svc06-app_texsas_14455"
| multikv noheader=t
``` Above prepare sample data ```
| rex field=_raw "Service ID - (?<serviceID>.*$)"
| table serviceID​

• use Splunk with rex

| makeresults 
| eval _raw ="2025-05-15T04:32:12.397Z INFO 1 --- [nio-8080-exec-4] x.y.z.y.LDAPAccountServiceImpl : [Request END] Failed : Cannot fetch secret for Vault Engine - XYXR_VPN_Engine, AIT - 9876 Service ID - zywstrf
2025-05-15T04:32:12.397Z INFO 1 --- [nio-8080-exec-4] x.y.z.y.LDAPAccountServiceImpl : [Request END] Failed : Cannot fetch secret for Vault Engine - XYXR_VPN_Engine, AIT - 9876 Service ID - abc123f
2025-05-15T04:32:12.397Z INFO 1 --- [nio-8080-exec-4] x.y.z.y.LDAPAccountServiceImpl : [Request END] Failed : Cannot fetch secret for Vault Engine - XYXR_VPN_Engine, AIT - 9876 Service ID - 1234-abcehu09_svc06-app_texsas_14455"
| multikv noheader=t
``` Above prepare sample data ```
| erex serviceID examples="zywstrf,abc123f"
| table serviceID​

• Use Splunk's "Extract new field" feature under "Interesting fields" and then select regex and follow those instructions. There are two more places in GUI where you could found this same functionality 😉

Please accept solution for answer which helps you to solve this issue. That way also other people will know what to do when they are looking an answer for same issue.