Splunk Search

Need a regex that extracts a string from event plus 6 characters after

Bleepie
Communicator

Dear Splunk Community,

I need help extracting a string (CTJT) plus any 6 characters after. CTJT is the start of an error code and always the same, the 6 characters after are different but always 6 charaters. Meaning the full error code is 10 characters like this: CTJTAAB013

The error codes in the events are always on random positions, never fixed!

I need to extract the errorcode and evaluate it in a field:

 

CTJT*
| table errorcode
| eval errorcode = "I want to fetch the error code here"

 

 

I have tried substr but I cant find a method for fetching the first index of CTJT. Can anyone help me create a regex that does the above or maybe some other way?

 

Thanks in advance

Labels (5)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex "(?<errorcode>CTJT\w{6})"

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "CTJT(?<errorcode>\w{6})"
0 Karma

Bleepie
Communicator

Hello IT Whisper, any idea on why no results are show even though there are 569 statistics show? When clicking on events I can see all events.

Bleepie_0-1632480823318.png

 

Tags (1)
0 Karma

Bleepie
Communicator

Little edit:

When I include _raw in the table I can see the following:

Bleepie_0-1632481104908.png

 

But its missing CTJT in front of it.

 

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "(?<errorcode>CTJT\w{6})"
0 Karma

Bleepie
Communicator

Thanks a lot sensei!

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...