How to create Rex for extracting a value from string?

[Coder1a]

Hello, I am new to splunk rex, need help for below to extract a value from string.

rex "Error while calling database for id = (?<id>.*)"

Example string: "Error while calling database for id =8748723874_1"

Output should be 8748723874

Thanks.

[yuanliu]

You didn't show the result or explain why the result is wrong.  Do you mean you just want to get rid of the part after underscore _?  Normally, Splunk should have given you a field id that contains value 8748723874_1.  If so, always work from the smaller data.  You do not need regex for this task.  Just do

| eval id = mvindex(split(id, "_"), 1)

If Splunk doesn't give you this field, you can do

| rex "Error while calling database for id\s*=\s*(?<id>[^_]+)"

Hope this helps