extraction help

valpravin — Tue, 20 Apr 2021 01:18:13 GMT

Hi Team

can you please help in extracting the 123456 from following string

hello world \"employee\":123456

Re: extraction help

bowesmana — Tue, 20 Apr 2021 01:26:01 GMT

Depending on whether your escaped quotes are in your data or not... This example includes the \ as part of the raw data string

| makeresults | eval _raw="hello world \\\"employee\\\":123456" | rex field=_raw "hello world \\\\\"employee\\\\\":(?<id>\d+)"

So, the 5 \ characters in rex will recognise the single \ in your data