Splunk Search

Need a regex that extracts a string from event plus 6 characters after

Bleepie
Communicator

Dear Splunk Community,

I need help extracting a string (CTJT) plus any 6 characters after. CTJT is the start of an error code and always the same, the 6 characters after are different but always 6 charaters. Meaning the full error code is 10 characters like this: CTJTAAB013

The error codes in the events are always on random positions, never fixed!

I need to extract the errorcode and evaluate it in a field:

 

CTJT*
| table errorcode
| eval errorcode = "I want to fetch the error code here"

 

 

I have tried substr but I cant find a method for fetching the first index of CTJT. Can anyone help me create a regex that does the above or maybe some other way?

 

Thanks in advance

Labels (5)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex "(?<errorcode>CTJT\w{6})"

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "CTJT(?<errorcode>\w{6})"
0 Karma

Bleepie
Communicator

Hello IT Whisper, any idea on why no results are show even though there are 569 statistics show? When clicking on events I can see all events.

Bleepie_0-1632480823318.png

 

Tags (1)
0 Karma

Bleepie
Communicator

Little edit:

When I include _raw in the table I can see the following:

Bleepie_0-1632481104908.png

 

But its missing CTJT in front of it.

 

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "(?<errorcode>CTJT\w{6})"
0 Karma

Bleepie
Communicator

Thanks a lot sensei!

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...