Regex help for incident

[priya0709]

I am using below query to fetch Incident from the subject line:—

rex field=subject max_match=0 “(?<Incident>INC\d+)”

however, for below subject line i am unable to fetch incident:—

[SecMail:] INC000027755501|TAS00003760220 wrdna904xusa73|server is unreachable | INC000027790458| INC000027882562

[Nisha18789 · Accepted solution]

Hello @priya0709 , your query looks fine, I have tried with the data of Subject field you have posted and I am able to see the extraction.

| makeresults
| eval subject="SecMail:] INC000027755501|TAS00003760220 wrdna904xusa73|server is unreachable | INC000027790458| INC000027882562"
| rex field=subject "(?<Incident>INC\d+)" max_match=0

[priya0709]

Thank you for your help

however, query did not work with the entire query. For the other subject line my query works but only for this specific subject it doesnt

i believe is the issue with the | sign just after the incident??

[Nisha18789]

Hi @priya0709 , one question- do you want to extract all the INC numbers in the Subject field or just the first one?

if you can post the entire query by replacing your specific fields and data with dummy data I can check further, as the subject you posted and the rex works perfectly fine for me, may be the issue is somewhere else.

[priya0709]

My requirement is to get all the incident from the subject line?

[isoutamo]

Hi

I just wondering that for some time before realised that for some reason your first example don't use " instead it use “ and ”.  For that reason it didn't work as expected after copy paste, even it was otherwise correct 😉

r. Ismo