About ra_52194724

ra_52194724

I want to capture only "uicgrupp=120 is lost" into uicgroup group as of now it's capturing "||0 CG00 uicgrupp=120 is lost: where "||0 CG00" information useless for me and should not be included in uicgroup group.

ra_52194724

i want to extract "uicgrupp=120 is lost" in one field after string matching <description": "Process> "description": "Process C5A13 uicgrupp=120 is lost" {"TOOL_Status": "OPEN", "description": "Process C5A13 uicgrupp=120 is lost", "Product_Name": "Application" "ORIGIN_Name": "Openazure","TOOL_Key": "58aa716bb1543", "TOOL_ID": "Openadcgbc"} {"TOOL_Status": "OPEN", "description": "Process ||0 CG00 uicgrupp=120 is lost", "Product_Name": "Application" "ORIGIN_Name": "Openazure","TOOL_Key": "58xx716bb1543", "TOOL_ID": "Openadcgbc"}

ra_52194724 · ‎03-22-2026

i'll be able to manage my use case as you provided regex. Help me the regex query if i have to from highlighted position. Example : APPL = T375P2 APPL = T375Q2 {"group_id": "aa2211-3b22-4263-8fe7-e7ef6c7859ed", "Status": "OPEN", "description": "aa01 : GOT EQQE056I JOB T375P201(JOB91552), OPERATION(0010), OPERATION TEXT( ), ENDED IN ERROR JCL . PRTY=1, APPL = T375P2 , WORK STATION = CPU4, IE= 2603161420, NO E2E RC", "hostname": "aa01", "CI_company": "zzz Group", "CEC_ID": "job-585796313", "ORIGIN_By_Product": "Microsoft"} {"group_id": "bb2211-3b22-4263-8fe7-e7ef6c7859ed", "Status": "OPEN", "description": "bb01 : GOT EQQE006I JOB T375Q201(JOB91632), OPERATION(0010), OPERATION TEXT( ), ENDED IN ERROR JCL . RTY=1, APPL = T375Q2 , WORK STATION = CPU5, IE= 2606661420, NO E2E RC", "hostname": "bb01", "CI_company": "xxx Group", "CEC_ID": "job-565796313", "ORIGIN_By_Product": "Microsoft"}

ra_52194724 · ‎03-21-2026

Can't we do it using props rather than writing two time inline rex command.?

ra_52194724 · ‎03-21-2026

Thanks .. it working fine. Could you please check my below problem. https://community.splunk.com/t5/Splunk-Enterprise/Regex-if-else-condition-posibilties/m-p/759539#M24022

ra_52194724 · ‎03-21-2026

I'm trying to extract fields using regex based on the condition. Below are the raw payload. {"group_id": "aa2211-3b22-4263-8fe7-e7ef6c7859ed", "Status": "OPEN", "description": "aa01 : GOT EQQE056I JOB T375P201(JOB91552), OPERATION(0010), OPERATION TEXT( ), ENDED IN ERROR JCL . PRTY=1, APPL = T375P2 , WORK STATION = CPU4, IE= 2603161420, NO E2E RC", "hostname": "aa01", "CI_company": "zzz Group", "CEC_ID": "job-585796313", "ORIGIN_By_Product": "Microsoft"} {"group_id": "bb2211-3b22-4263-8fe7-e7ef6c7859ed", "Status": "OPEN", "description": "bb01 : GOT EQQE006I JOB T375Q201(JOB91632), OPERATION(0010), OPERATION TEXT( ), ENDED IN ERROR JCL . RTY=1, APPL = T375Q2 , WORK STATION = CPU5, IE= 2606661420, NO E2E RC", "hostname": "bb01", "CI_company": "xxx Group", "CEC_ID": "job-565796313", "ORIGIN_By_Product": "Microsoft"} i want to extract highlighted value as field <core_key> based on the hostname. if hostname matches aa01 than core_key =T37 if hostname matches bb01 than core_key =75Q

ra_52194724 · ‎12-14-2025

i want to extract last word in resource_id field from below events.

ra_52194724 · ‎10-27-2025

I have around 100 services created in service dependency view but not able to find the way to populated impacted service in episode using correlation search. When do i select impacted service manually while creating correlation search then i would able to see the impacted services in episode but can we populate automatically rather then selecting manually.

Posts	10
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎07-11-2025

Online Status	Offline
Date Last Visited	Thursday

regex help required

Regex if else condition posibilties

extract specific field

Splunk ITSI impacted service automation

Re: regex help required

regex help required

Re: Regex if else condition posibilties

Re: Regex if else condition posibilties

Re: extract specific field

Regex if else condition posibilties

extract specific field

Splunk ITSI impacted service automation

Join the Conversation