try this:
index=<your_index> |rex "(\d|\w)\d{3}_\d{3}01(?<EventId>\d{4})"
also, try this run anywhere search:
| makeresults
| eval data="054100172.23.47.142 20191025183818S617_0310120060387212200090541SEG_EAltaSesOpe 0000000000000000000000000000JR388400000000000 C200-025C96D22DA|1010000000D9,999900 20191025183334S617_0310130020571272600120541ConsultaLDAP 0000000000000000000000000000JB146000000000001 149029 3C0CFF0F|0000000000D9"
| makemv data delim=","
| mvexpand data
| rex field=data "(\d|\w)\d{3}_\d{3}01(?<EventId>\d{4})"
... View more