can't extract the field, below error shows up,

[simranrathi]

Argument 'value' contains invalid character : ^[\d+;\d+\w+\s+\d+-\d+-\d+\s+\d+:\d+:\d+,\d+\s+[\w+::\w+.\w+.\w+.\w+.\w+.\w+.\w+]\s+[][][\w+\d+][][](\w+)\s+[\w+]\s+\w+\s+\w+\s+\d+\s+\w+\s+[\w+.\w+.\w+.\w+:\s+\w+\s+\w+\s+\w+\s+\w+[\w+:\d+,(?P[^,]+)

I'm trying to run this query to extract fields
index=tomcat (java.sql.SQLException: ORA-12899: value too large for column "NLHYP_USER"."PRODUCTSLP"."P_WASHCARE")
| rex field=message_text "itemPK:\s(?[^\,]+)" | rex field=message_text "langPK:\s(?[^\,]+)"

This field has to be extracted::

[itemPK:8977222991873,langPK:8796093120544,

[simranrathi]

I've tried this
but it is only showing me the results for this particular event
I want more of a generic search to extract all the events' fields

[mayurr98]

for that, you would need to give me sample data of all such events. No one can give you regex without seeing at the events. Please provide all sample different types of events from which you want to extract these fields.

[niketn]

@simranrathi while posting code/data use the code button on Splunk Answers i.e. 101010 or Shortcut Ctrl+K so that special characters do not escape.

[mayurr98]

Try this run anywhere search

| makeresults 
| eval message_text="[itemPK:8977222991873,langPK:8796093120544," 
| rex field=message_text "itemPK:(?<itemPK>[^\,]+)\,langPK:(?<langPK>[^\,]+)"

In your environment you should try

index=tomcat (java.sql.SQLException: ORA-12899: value too large for column "NLHYP_USER"."PRODUCTSLP"."P_WASHCARE") 
| rex field=message_text  "itemPK:(?<itemPK>[^\,]+)\,langPK:(?<langPK>[^\,]+)"

let me know if this helps!