Fri Feb 22 20:52:59 2013 390603 : Failure during SQL operation to the database : ORA-00942: table or view does not exist (ARERR 552)
Fri Feb 22 20:52:59 2013 390603 : Failure during SQL operation to the database : ORA-00942: table or view does not exist (ARERR 552)
Fri Aug 31 16:54:19 2012 Sig-Cancelled - AP:Signature - 000000000031602|000000000017692
Fri Aug 31 16:54:19 2012 Approve : Operation cancelled due to error (ARAPPNOTE 4502)
Fri Aug 31 16:54:19 2012 Sig-Cancelled - AP:Signature - 000000000023551|000000000014287
Fri Aug 31 16:54:19 2012 Approve : Operation cancelled due to error (ARAPPNOTE 4502)
is the sample data. looking to extract only last field within ( ) error code and the text before it starting from :.*(AR* 111)
tried several rex and extraction as the data but no luck.
looking for help
thanks
Sri
Wondering if this works.
.. | rex field=_raw "\(AR\S+\s+(?<error>[^\)]+)\)"