REGEX with variabilities in Data Length/Structure/Type

[SplunkDash]

2019-06-201 09:05:22.945,  User: XX, EType: SIGN, Filter: 000000000, EventId: SIGNATURE, Id: 028119296, UserIdType: xxx, Address: 000.000.100.100, SystemName: Neno, SId: adb155b9-b3aa-4a64-8312-33f8f41de96d, TransType: SDLN, Tid: 9200001193, UserNm: xxx aaa, UType: yyyy, UId: 67B7-xxxx-bbbb-6abr-E0B1D9B6083B, Level: BoM3, Form: MOB, IntentId: 531, Timestamp: 2019-06-29T14:05:22.954Z, ExtCode: 00, Message: null. 2019-06-21 06:30:30.107, User: YYY, EType: noSIGN, Filter: 000000000, EventId: No_SIGNATURES,Id: 00234545345-, Address: 000.111.222.005, SystemName: Neno, SId: =/=S()A.b(X(-yJrV/+do)f(Q_)uW-/6+o_v.k|3dOYc+Fh_=YOX-iDA++===, TType: CAF_dLn, TId: ThisIsAutomation, ExtCode: 00, Message: null.

I included 2 sample events. My objective is to extract "Sid" field values. The field values should contain all text between SId and ExtCode (Highlighted as Bold RED). Any help will be highly appreciated! Thank you.

[richgalloway]

This should do it.

| rex "SId: (?<sid>.*?), ExtCode"

[SplunkDash]

I used this....

SId:\s+(?P<sid>SId:  .*),  EXTCode

But not working....

[ITWhisperer]

You have used Sid: twice in the expression - use it once as I suggested.

[SplunkDash]

Oh yes....thank you...working as expected, appreciated 😊!!!

[richgalloway]

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

[SplunkDash]

I would also like to add a text  "SID:" as a part of  "sid" field values ...any help would be highly appreciated!

Thank you and Regards

[ITWhisperer]

| rex "(?<sid>SId: .*?), ExtCode"