https://community.splunk.com/t5/Splunk-Search/how-to-eval-new-field-to-filter-events-by-a-number-in-the-raw/m-p/259420#M175854 <P>@annamareddi - Did the answer provided by jplumsdaine22 help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!</P> Sun, 12 Feb 2017 04:28:31 GMT aaraneta_splunk 2017-02-12T04:28:31Z https://community.splunk.com/t5/Splunk-Search/how-to-eval-new-field-to-filter-events-by-a-number-in-the-raw/m-p/259418#M175852 <P>i want to filter my data, based on the key numbers present in raw events.<BR /> example<BR /> event1:<BR /> sdfgn dfnlk 1/25/2017 ldjod djf lkd "iuhdfsadk sdkdljnkdl :key:123"jhdjdckl lcsdlkd </P> <P>event2:<BR /> sdfgn dfnlk 1/25/2017 ldjod djf lkd "iuhdfsadk sdkdljnkdl :key:134"jhdjdckl lcsdlkd </P> <P>event3:<BR /> sdfgn dfnlk 1/25/2017 ldjod djf lkd "iuhdfsadk sdkdljnkdl :key:1059"jhdjdckl lcsdlkd </P> <P>event4:<BR /> sdfgn dfnlk 1/25/2017 ldjod djf lkd "iuhdfsadk sdkdljnkdl :key:1059"jhdjdckl lcsdlkd </P> <P>i dont want repeated values, so i want the unique key values.</P> <P>how to eval new field to filter this data by key values.</P> Wed, 25 Jan 2017 10:42:18 GMT https://community.splunk.com/t5/Splunk-Search/how-to-eval-new-field-to-filter-events-by-a-number-in-the-raw/m-p/259418#M175852 annamareddi 2017-01-25T10:42:18Z https://community.splunk.com/t5/Splunk-Search/how-to-eval-new-field-to-filter-events-by-a-number-in-the-raw/m-p/259419#M175853 <P>Do you mean that the field is not being extracted? You could use rex to create a new field:</P> <PRE><CODE>... | rex ":key:(?&lt;key&gt;[^\"]+)" </CODE></PRE> <P>and then you can use the field with stats etc. EG</P> <PRE><CODE>... | rex ":key:(?&lt;key&gt;[^\"]+)" | stats count by key </CODE></PRE> Thu, 26 Jan 2017 13:11:56 GMT https://community.splunk.com/t5/Splunk-Search/how-to-eval-new-field-to-filter-events-by-a-number-in-the-raw/m-p/259419#M175853 jplumsdaine22 2017-01-26T13:11:56Z https://community.splunk.com/t5/Splunk-Search/how-to-eval-new-field-to-filter-events-by-a-number-in-the-raw/m-p/259420#M175854 <P>@annamareddi - Did the answer provided by jplumsdaine22 help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!</P> Sun, 12 Feb 2017 04:28:31 GMT https://community.splunk.com/t5/Splunk-Search/how-to-eval-new-field-to-filter-events-by-a-number-in-the-raw/m-p/259420#M175854 aaraneta_splunk 2017-02-12T04:28:31Z