RegEx or Field Transformation ?

[righettod]

Hello,

I have an event that have this format:

[13/01/31@00:14:05.269+0100] P-1770312 T-000001 1 AS -- (Procedure: 'put-one-message llwks.c' Line:1610) ** Attempt to write to closed stream swk-log. (1387)

I try to find (since some days ago) a RegEx expression in order to extract the value "1387" but without selecting the "()" in the target extracted value.

Is it possible to achieve this by RegEx or must I use Field Transformation ?

Thanks in advance for your helps ;o)))

Dominique

[sbrant_splunk · Accepted solution]

You actually don't need transforms, you could put the following into props.conf on the search head (remove the \ that precedes the word MyField, I had to put that in there for formatting purposes):

EXTRACT-field = (?<\MyField>\d+)\)$

This would go in the stanza for the source/sourcetype in question.

[wpreston]

How about something like this? You may need to customize it further to match other samples of your data.

...your search... | rex "[(](?<MyField>\d+)[)]"