https://community.splunk.com/t5/Splunk-Search/extract-string-from-raw-data/m-p/528032#M149065 <P>Use rex.</P><LI-CODE lang="markup">... | rex "is: (?&lt;numFiles&gt;\d+)" | stats sum(numFiles) as TotalFiles | where TotalFiles &gt; 500</LI-CODE> Wed, 04 Nov 2020 21:56:22 GMT richgalloway 2020-11-04T21:56:22Z https://community.splunk.com/t5/Splunk-Search/extract-string-from-raw-data/m-p/528030#M149064 <P>Hello need help to extract the number from this result:</P><P><SPAN class="t">Total</SPAN> <SPAN class="t">number</SPAN> <SPAN class="t">of</SPAN> <SPAN class="t">files</SPAN> <SPAN class="t">under</SPAN> <SPAN class="t">/wmq/logs/AMXDEVRC120/active</SPAN> <SPAN class="t">is:</SPAN> <SPAN class="t">184</SPAN></P><P>i'm trying to get the total number of files from this directory and compare if over 500.&nbsp;</P><P>&nbsp;</P><P>thank you,&nbsp;</P><P>&nbsp;</P> Wed, 04 Nov 2020 21:46:08 GMT https://community.splunk.com/t5/Splunk-Search/extract-string-from-raw-data/m-p/528030#M149064 owie6466 2020-11-04T21:46:08Z https://community.splunk.com/t5/Splunk-Search/extract-string-from-raw-data/m-p/528032#M149065 <P>Use rex.</P><LI-CODE lang="markup">... | rex "is: (?&lt;numFiles&gt;\d+)" | stats sum(numFiles) as TotalFiles | where TotalFiles &gt; 500</LI-CODE> Wed, 04 Nov 2020 21:56:22 GMT https://community.splunk.com/t5/Splunk-Search/extract-string-from-raw-data/m-p/528032#M149065 richgalloway 2020-11-04T21:56:22Z https://community.splunk.com/t5/Splunk-Search/extract-string-from-raw-data/m-p/528355#M149185 <P>thanks for the help</P><P>&nbsp;</P> Fri, 06 Nov 2020 17:26:22 GMT https://community.splunk.com/t5/Splunk-Search/extract-string-from-raw-data/m-p/528355#M149185 owie6466 2020-11-06T17:26:22Z