How to extract string from a paragraph?

[ppanchal]

Hi,
Below is my paragraph and I want to extract the routeorder value from the paragraph.

Please assist.

other_app_launch_data:   Third Party App Launch Data:354736071554019 Data passed:Bundle{service_url : http://example.com/service; site_number : S04136; vehicle_id : 210648; driver_id : 082775; pre_post : post; tabletid : 354736071554019; first_name : Gennadiy; environment : Production; fuel : ; route_id : ***ROUTEORDER#**158682677**;*** device_id : 354736071554019; DVIR_RESPONSE_ACTION : DVIR_POST_CHECK_RESPONSE; meter_time : 717; meter_distance : 161724; last_name : Trofimchik;  }Bundle reqCode:9804

[sudosplunk · Accepted solution]

Hi there,

Try this,

your_search | rex field=_raw "route_id\s\:\s\w+\#(?<ROUTEORDER>\d+)"

[ppanchal]

No this did not work. I am not getting anything with the search.

[sudosplunk]

Is it giving any error? Are able to see ROUTEORDER field under interesting fields section? Also, can you paste a screenshot of data along with your search.

[ppanchal]

yes, i got it thanks.

[sudosplunk]

Great. Please accept the answer if it helped you.