rex extraction for field value with space

[nikkkc]

hi,
would someone be so kind and help me to build a rex expression? i want to extract all "Audit ID" from this sample Log:

May 31 17:36:05 xxx.xxx.xxx.xxx May 31 17:37:04 mail33 ecelerity[23851]: ML-REJECT: Rejection on: xxx.x.xx.x:25, sent to host: 111.1111.111.111:56482, Audit ID ac13e885-1234567-32-574dafa09655, 554 5.7.1 You are not allowed to connect.#015

i want the hole text after the "Audit ID" string until the next comma.
Thanks in advanced

[richgalloway · Accepted solution]

This works on regex101.com with your sample event.

... | rex "Audit ID (?<auditID>[^,]*)" | ...

[nikkkc]

Thank you, this is exactly what i had, but now i realized the real problem: I forgot to mention that there are a lot of Events without the Audit ID and then it doesnt work. In approx. 200 Events the Audit ID is present just a few times. If i pre-filter the Events then the rex works !!
i do not understand this behaivor...

[richgalloway]

If an event does not contain the Audit ID field then rex will fail to find it. Any part of your query which relies on the Audit ID field will also fail.

The presence of the Audit ID field in a event is controlled by the application, not by Splunk.

[nikkkc]

i believe you missanderstood, it´s right if an event does not contain the Audit Id field rex will fail to find it, this is a normal behavior. But if i have 100 Events in summary and 10 of them contains the Audit ID i would like to have the new field auditID with 80 NULL values and 10 correct matches.

[richgalloway]

Ah. Then you would want the fillnull command.

[nikkkc]

...and i have to search for "Audit ID" because the ID is not always on the same place! i tried a lot but nothing works