Splunk Search

How to write the regex to extract the error code from my sample log?

New Member

How can I find all the error codes from the logs and show it as interesting field?
e.g. Message : Information with Insured. (PL200XXX)
Here PLXXXXX is the error code within the parentheses. What regex or search criteria should I use to make this work? I am new to Splunk and exploring it.

Thanks a lot for your help.

0 Karma


If the error code always starts with PL and there are other values between ( ) in your data.
.. | rex "\((?<err_code>PL\w+)\)"

Good Luck!


This one is pretty simple.

sourcetype=yoursourcetype | rex field=_raw "\((?<errorcode>[^)]+)\)"

This should give you the results you want in errorcode. This is a very quick regex - if you are going to make it "production ready", don't use rex, use the props/transforms to pull it automatically.

New Member

Thanks a lot guys! I will surely try it today.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...