Hello,
I have an event that have this format:
[13/01/31@00:14:05.269+0100] P-1770312 T-000001 1 AS -- (Procedure: 'put-one-message llwks.c' Line:1610) ** Attempt to write to closed stream swk-log. (1387)
I try to find (since some days ago) a RegEx expression in order to extract the value "1387" but without selecting the "()" in the target extracted value.
Is it possible to achieve this by RegEx or must I use Field Transformation ?
Thanks in advance for your helps ;o)))
Dominique
You actually don't need transforms, you could put the following into props.conf on the search head (remove the \ that precedes the word MyField, I had to put that in there for formatting purposes):
EXTRACT-field = (?<\MyField>\d+)\)$
This would go in the stanza for the source/sourcetype in question.
You actually don't need transforms, you could put the following into props.conf on the search head (remove the \ that precedes the word MyField, I had to put that in there for formatting purposes):
EXTRACT-field = (?<\MyField>\d+)\)$
This would go in the stanza for the source/sourcetype in question.
How about something like this? You may need to customize it further to match other samples of your data.
...your search... | rex "[(](?<MyField>\d+)[)]"