https://community.splunk.com/t5/Splunk-Search/How-do-you-extract-the-value-of-output-quality-from-the-log/m-p/448225#M127003 <P>rex <CODE>field=logs</CODE> max_match=0 </P> <P>You should use the field which contains the logs.. or "_raw"</P> <P><CODE>rex field=_raw max_match=0</CODE></P> Tue, 30 Oct 2018 09:21:25 GMT inventsekar 2018-10-30T09:21:25Z https://community.splunk.com/t5/Splunk-Search/How-do-you-extract-the-value-of-output-quality-from-the-log/m-p/448222#M127000 <P>I want to extract the value of Output Quality from the below log.</P> <PRE><CODE>Critical-Lab checkRcReady for batchId ==&gt;9a508f01-4e93-4d76-9a9d-fe1cf8bd0550==true :: Output Quality 0.0%" </CODE></PRE> <P>Output Quality is 0.0%. I want to extract this value. How do you do it with regex?</P> Mon, 29 Oct 2018 06:21:20 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-extract-the-value-of-output-quality-from-the-log/m-p/448222#M127000 abhishekgandhe 2018-10-29T06:21:20Z https://community.splunk.com/t5/Splunk-Search/How-do-you-extract-the-value-of-output-quality-from-the-log/m-p/448223#M127001 <P>Update- included the max_match - </P> <PRE><CODE>| makeresults | eval logs = "batchId ==&gt;ceba8481-7806-4b03-a8c9-811bdc340a05==true :: Output Quality 7.2% batchId ==&gt;04b0800f-74e2-4522-bfd0-9621af9d4536==true :: Output Quality 9.5% batchId ==&gt;d66872a1-4cf7-433c-a86d-d7ac097537d8==true :: Output Quality 34.28% batchId ==&gt;3d4606ec-f607-4187-9f58-47d88f99ac0a==true :: Output Quality 90.34%" | rex field=logs max_match=0 "Output Quality (?P&lt;Quality&gt;\d+\.\d+\%)" | table Quality logs </CODE></PRE> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/5991i06727A68428B3A61/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Mon, 29 Oct 2018 11:16:29 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-extract-the-value-of-output-quality-from-the-log/m-p/448223#M127001 inventsekar 2018-10-29T11:16:29Z https://community.splunk.com/t5/Splunk-Search/How-do-you-extract-the-value-of-output-quality-from-the-log/m-p/448224#M127002 <P>I just don't have 4 lines, but there are multiple lines. How to write one REGEX.<BR /> I tried below REGEX, but could not got the desired result.</P> <P>index="cpsprod" sourcetype="mscs:storage:blob:cps-qa-rc-calc" "batchId ==&gt;""==true :: Output Quality" | rex field=logs max_match=0 "Output Quality (?P\d+.\d+\%)" | table Quality</P> Tue, 30 Oct 2018 06:43:11 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-extract-the-value-of-output-quality-from-the-log/m-p/448224#M127002 abhishekgandhe 2018-10-30T06:43:11Z https://community.splunk.com/t5/Splunk-Search/How-do-you-extract-the-value-of-output-quality-from-the-log/m-p/448225#M127003 <P>rex <CODE>field=logs</CODE> max_match=0 </P> <P>You should use the field which contains the logs.. or "_raw"</P> <P><CODE>rex field=_raw max_match=0</CODE></P> Tue, 30 Oct 2018 09:21:25 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-extract-the-value-of-output-quality-from-the-log/m-p/448225#M127003 inventsekar 2018-10-30T09:21:25Z