Splunk Search

Help with regular expression

indianhans
Engager

I wish to extract any number between "cmdbRequest" & "- Transaction" . For Example from below string

ERROR 21 CMDB cmdbRequest 1089798797 - Transaction Null: 10/21/2015 07:25:34 - Exception: ORA-12578: TNS:wallet open failed

i wish to extract 1089798797

i have wrtten below regular expression to get the number, but its giving me a null value.

| rex "CMDBRequest(?P<Request_ID>.*?)Transaction" |

Can anyone please help ?

0 Karma

bevant
Explorer

won't you need to cater for the stuff either side (spaces/dashes?

rex "cmdbRequest\s(?<Request_ID>\d+)\s\-\sTransaction"

...or something like that, depending on how consistent you expect it to all be. I've not tested it, but it might put you on the correct path

0 Karma

abhijitmishra87
Explorer

Please try the following :

| rex "cmdbRequest(?P<Request_ID>\d+)Transaction" |
0 Karma
Get Updates on the Splunk Community!

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...