https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Query-related/m-p/487374#M8080 <P>I've written below query,</P> <P>index=* sourcetype=* EventCode=* | rex field=_raw "((Process Command Line:\t)(?(.+)*))" |stats count by field.</P> <P>Tried extracting "Process Command line" field. After extracting i can see that though it doesn't contain any value(not even spaces), Splunk is not taking it as NULL.Instead it is taking as if field has some command line.</P> <P>Could you please help?</P> Wed, 20 Nov 2019 09:56:54 GMT rupesh67nikam 2019-11-20T09:56:54Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Query-related/m-p/487374#M8080 <P>I've written below query,</P> <P>index=* sourcetype=* EventCode=* | rex field=_raw "((Process Command Line:\t)(?(.+)*))" |stats count by field.</P> <P>Tried extracting "Process Command line" field. After extracting i can see that though it doesn't contain any value(not even spaces), Splunk is not taking it as NULL.Instead it is taking as if field has some command line.</P> <P>Could you please help?</P> Wed, 20 Nov 2019 09:56:54 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Query-related/m-p/487374#M8080 rupesh67nikam 2019-11-20T09:56:54Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Query-related/m-p/487375#M8081 <P>could you please provide samples of your raw event and what you want to extract out of that?</P> Wed, 20 Nov 2019 13:04:12 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Query-related/m-p/487375#M8081 Sukisen1981 2019-11-20T13:04:12Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Query-related/m-p/487376#M8082 <P>Hi @rupesh67nikam,<BR /> I cannot read you search, you should insert it in Sample Code.</P> <P>Anyway, in your regex I see spaces in field name (but could be a visualization error) and it's better not use them.<BR /> Then in stats count BY field command, you should use a field name (not field), e.g. something like</P> <PRE><CODE>| stats count by Process_Command_Line </CODE></PRE> <P>or </P> <PRE><CODE>| stats count by "Process Command Line" </CODE></PRE> <P>Ciao.<BR /> Giuseppe</P> Wed, 20 Nov 2019 13:30:24 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Query-related/m-p/487376#M8082 gcusello 2019-11-20T13:30:24Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Query-related/m-p/487377#M8083 <P>Please Provide the Sample log, So that we can see if is there any issue with rex or something else.</P> <P>Normally rex syntax is like below.<BR /> <CODE>(?&lt;Field_Name&gt;Regular_Expression)</CODE></P> Thu, 21 Nov 2019 12:05:34 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Query-related/m-p/487377#M8083 vikcee 2019-11-21T12:05:34Z