Splunk Search

Need a regex that extracts a string from event plus 6 characters after

Bleepie
Communicator

Dear Splunk Community,

I need help extracting a string (CTJT) plus any 6 characters after. CTJT is the start of an error code and always the same, the 6 characters after are different but always 6 charaters. Meaning the full error code is 10 characters like this: CTJTAAB013

The error codes in the events are always on random positions, never fixed!

I need to extract the errorcode and evaluate it in a field:

 

CTJT*
| table errorcode
| eval errorcode = "I want to fetch the error code here"

 

 

I have tried substr but I cant find a method for fetching the first index of CTJT. Can anyone help me create a regex that does the above or maybe some other way?

 

Thanks in advance

Labels (5)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex "(?<errorcode>CTJT\w{6})"

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "CTJT(?<errorcode>\w{6})"
0 Karma

Bleepie
Communicator

Hello IT Whisper, any idea on why no results are show even though there are 569 statistics show? When clicking on events I can see all events.

Bleepie_0-1632480823318.png

 

Tags (1)
0 Karma

Bleepie
Communicator

Little edit:

When I include _raw in the table I can see the following:

Bleepie_0-1632481104908.png

 

But its missing CTJT in front of it.

 

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "(?<errorcode>CTJT\w{6})"
0 Karma

Bleepie
Communicator

Thanks a lot sensei!

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...