https://community.splunk.com/t5/Splunk-Enterprise/Using-rex-to-filter-fields/m-p/531162#M4308 <LI-CODE lang="markup">rex "attr_actor_agent_id\s\[str\]\s\=\s\"[\w_]+_(?&lt;agent_id&gt;\d+)\""</LI-CODE> Fri, 27 Nov 2020 13:57:03 GMT ITWhisperer 2020-11-27T13:57:03Z https://community.splunk.com/t5/Splunk-Enterprise/Using-rex-to-filter-fields/m-p/531157#M4307 <P><SPAN>Hello everyone,</SPAN><BR /><BR /><SPAN>I have the following pattern of logs and I'm trying to use rex to filter the values, but I'm having problems because of + in some events, can you help me?<BR /><BR />I started doing it like this:&nbsp;&nbsp;| rex field=_raw "attr_actor_agent_id\s(?&lt;agent_id&gt;.*)"</SPAN><BR /><BR /><SPAN>I need to get only the last 04 digits after "_"</SPAN></P><P>Example: 1243, 3232, 1122, 5454, etc.</P><P>&nbsp;</P><LI-CODE lang="markup">attr_actor_agent_id [str] = "LB_DFSVGLQ_1243" attr_actor_agent_id [str] = "AT_APARPRI_3232" attr_actor_agent_id [str] = "TR_REGIBEL_1122" attr_actor_agent_id [str] = "GP_DAYAPAN_5454" attr_actor_agent_id [str] = "LB_BIANIBR_5454" attr_actor_agent_id [str] = "AS_NAYRVIE_3232" attr_actor_agent_id [str] = "AS_LUMANAS_4343" attr_actor_agent_id [str] = "AS_MBCEVDJ_9111" attr_actor_agent_id [str] = "LB_SILVWAN_4343"</LI-CODE><P>&nbsp;</P><P>&nbsp;</P> Fri, 27 Nov 2020 13:47:49 GMT https://community.splunk.com/t5/Splunk-Enterprise/Using-rex-to-filter-fields/m-p/531157#M4307 leandromatperei 2020-11-27T13:47:49Z https://community.splunk.com/t5/Splunk-Enterprise/Using-rex-to-filter-fields/m-p/531162#M4308 <LI-CODE lang="markup">rex "attr_actor_agent_id\s\[str\]\s\=\s\"[\w_]+_(?&lt;agent_id&gt;\d+)\""</LI-CODE> Fri, 27 Nov 2020 13:57:03 GMT https://community.splunk.com/t5/Splunk-Enterprise/Using-rex-to-filter-fields/m-p/531162#M4308 ITWhisperer 2020-11-27T13:57:03Z