https://community.splunk.com/t5/Splunk-Search/Extract-value-within-quotes-and-plot-on-timechart/m-p/355058#M105047 <P>Hi,</P> <P>I am very new to splunk and i have data like this below:</P> <P>"salary": "2000"</P> <P>I have 1000's of events like this, I would like to extract only the integer 2000 and plot the value on timechart.</P> <PRE><CODE>source="tcp:8050" | search salary| rex _raw=".*(?P&lt;sal&gt;\d+).*" | timechart count as "SAL" </CODE></PRE> <P>The above search is only returning the number of events having salary but not returning the actual value of 2000.<BR /> Requests help to achieve this!!!<BR /> Thanks!!</P> Fri, 22 Sep 2017 16:55:34 GMT skenkere 2017-09-22T16:55:34Z https://community.splunk.com/t5/Splunk-Search/Extract-value-within-quotes-and-plot-on-timechart/m-p/355058#M105047 <P>Hi,</P> <P>I am very new to splunk and i have data like this below:</P> <P>"salary": "2000"</P> <P>I have 1000's of events like this, I would like to extract only the integer 2000 and plot the value on timechart.</P> <PRE><CODE>source="tcp:8050" | search salary| rex _raw=".*(?P&lt;sal&gt;\d+).*" | timechart count as "SAL" </CODE></PRE> <P>The above search is only returning the number of events having salary but not returning the actual value of 2000.<BR /> Requests help to achieve this!!!<BR /> Thanks!!</P> Fri, 22 Sep 2017 16:55:34 GMT https://community.splunk.com/t5/Splunk-Search/Extract-value-within-quotes-and-plot-on-timechart/m-p/355058#M105047 skenkere 2017-09-22T16:55:34Z https://community.splunk.com/t5/Splunk-Search/Extract-value-within-quotes-and-plot-on-timechart/m-p/355059#M105048 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/71022">@skenkere</a><BR /> try this,</P> <P>your search here | rex field=_raw "\"salary\":\s+\"(?P&lt;\d+&gt;)\"" | timechart count by sal_value</P> Tue, 29 Sep 2020 15:51:02 GMT https://community.splunk.com/t5/Splunk-Search/Extract-value-within-quotes-and-plot-on-timechart/m-p/355059#M105048 sbbadri 2020-09-29T15:51:02Z