https://community.splunk.com/t5/Getting-Data-In/How-to-extract-this-data-from-the-log/m-p/608169#M105539 <P>Hello,</P><P>I am fairly new to using splunk. I am having some trouble understanding how to extract the fields.&nbsp;</P><P>My sample data looks somewhat like this:</P><P>...Event={request=Request{data={firstName=jane, lastName=doe, yearOfBirth=1996}}}...</P><P>I want to get count based on yearOfBirth. How should I do it?</P><P>I tried doing <STRONG>stats count by request.data.yearOfBirth</STRONG>,&nbsp;and also tried simply doing <STRONG>stats count by yearOfBirth</STRONG> but neither returned any results. Am I accessing the yearOfBirth field incorrectly?<BR />How can I&nbsp;</P> Wed, 03 Aug 2022 19:30:16 GMT as2050 2022-08-03T19:30:16Z https://community.splunk.com/t5/Getting-Data-In/How-to-extract-this-data-from-the-log/m-p/608169#M105539 <P>Hello,</P><P>I am fairly new to using splunk. I am having some trouble understanding how to extract the fields.&nbsp;</P><P>My sample data looks somewhat like this:</P><P>...Event={request=Request{data={firstName=jane, lastName=doe, yearOfBirth=1996}}}...</P><P>I want to get count based on yearOfBirth. How should I do it?</P><P>I tried doing <STRONG>stats count by request.data.yearOfBirth</STRONG>,&nbsp;and also tried simply doing <STRONG>stats count by yearOfBirth</STRONG> but neither returned any results. Am I accessing the yearOfBirth field incorrectly?<BR />How can I&nbsp;</P> Wed, 03 Aug 2022 19:30:16 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-extract-this-data-from-the-log/m-p/608169#M105539 as2050 2022-08-03T19:30:16Z https://community.splunk.com/t5/Getting-Data-In/How-to-extract-this-data-from-the-log/m-p/608178#M105540 <P>Check what fields are available in your data by checking field sidebar (left hand panel when you run your search). You can click on a field so see what way the field should be referred.&nbsp;</P><P>If you don't see any relevant field extracted, make sure that you're using correct Search mode (dropdown below time range picker, select Smart Mode OR Verbose Mode). If you still don't see a field for yearOfBirth, try this</P><LI-CODE lang="markup">your base search (index=x sourcetype=y) | rex "yearOfBirth\=(?&lt;yearOfBirth&gt;\d+)" | stats count by yearOfBirth</LI-CODE> Wed, 03 Aug 2022 20:08:49 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-extract-this-data-from-the-log/m-p/608178#M105540 somesoni2 2022-08-03T20:08:49Z