What's the wrong in this search?

[jangid]

I want to extract processid from my log and here is query

eventtype=statustrace | regex _raw="^[IEWF]" | rex field=_raw "(?i)^(?:[^ ]* ){2}(?P[^ ]+)" | table _raw ProcessID

this return following result

    I0704 16:04:06.612287 3690 logger_c.cpp:42] ThreadData.c:5253 STATUSTRACE: 14, INPUT
    I0704 16:04:06.611132 3690 logger_c.cpp:42] ThreadData.c:5253 STATUSTRACE: 11, NORMAL

47653 I0704 11:14:28.963080 47653 logger_c.cpp:42] ThreadData.c:5253 STATUSTRACE: 11, NORMAL
47653 I0704 11:14:12.682859 47653 logger_c.cpp:42] ThreadData.c:5253 STATUSTRACE: 12, SLEEPING

Why its not return 3690 in first two row?
is something wrong my regular expression?

[ahall_splunk · Accepted solution]

Yes, there is something wrong with your regex. At least, it didn't match your data. I use an online regular expression tester for testing these sorts of things. Online, you can try: http://www.regextester.com/ - offline, I use an Eclipse plug-in.

Try something like:

rex field=_raw "^[IEWF]\d+ [0-9:\.]+ (?<processid>\d+)"

[jangid]

Thanks for your reply

below regex solved my problem
rex field=_raw "\w+\s\d+:\d+:\d+.\d+\s+(?\d+)\s"

[ahall_splunk]

Field names are case sensitive, so ensure your extraction matches the field in the table command.

[jangid]

same result with your regex 😞

[jangid]

I have noticed one thing if process id is 5 or more digit then it'll search other wise it'll not