Splunk Search

Regex help for incident

Path Finder

I am using below query to fetch Incident from the subject line:—

rex field=subject max_match=0 “(?<Incident>INC\d+)”

however, for below subject line i am unable to fetch incident:—

[SecMail:] INC000027755501|TAS00003760220 wrdna904xusa73|server is unreachable | INC000027790458| INC000027882562

0 Karma
1 Solution

Builder

Hello @priya0709 , your query looks fine, I have tried with the data of Subject field you have posted and I am able to see the extraction.

| makeresults
| eval subject="SecMail:] INC000027755501|TAS00003760220 wrdna904xusa73|server is unreachable | INC000027790458| INC000027882562"
| rex field=subject "(?<Incident>INC\d+)" max_match=0

View solution in original post

0 Karma

Builder

Hello @priya0709 , your query looks fine, I have tried with the data of Subject field you have posted and I am able to see the extraction.

| makeresults
| eval subject="SecMail:] INC000027755501|TAS00003760220 wrdna904xusa73|server is unreachable | INC000027790458| INC000027882562"
| rex field=subject "(?<Incident>INC\d+)" max_match=0

View solution in original post

0 Karma

Path Finder

Thank you for your help

however, query did not work with the entire query. For the other subject line my query works but only for this specific subject it doesnt

i believe is the issue with the | sign just after the incident??

0 Karma

Builder

Hi @priya0709 , one question- do you want to extract all the INC numbers in the Subject field or just the first one?

if you can post the entire query by replacing your specific fields and data with dummy data I can check further, as the subject you posted and the rex works perfectly fine for me, may be the issue is somewhere else.

0 Karma

Path Finder

My requirement is to get all the incident from the subject line?

0 Karma

Champion

Hi

I just wondering that for some time before realised that for some reason your first example don't use " instead it use “ and ”.  For that reason it didn't work as expected after copy paste, even it was otherwise correct 😉

r. Ismo

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!