https://community.splunk.com/t5/Splunk-Search/Regex-in-search-key/m-p/101919#M26329 <P>I have a log with entries like this: region.0="us" region.1="us_west" region.2="us_west_pacific" region.3="us_ca". The order and number of the values associated with the region keys is arbitrary. I'm new to splunk. I want to query for all logs where "us_west" is assigned to any of the region keys, basically something like: region.[0-9]="us_west". Is this possible?</P> Mon, 28 Sep 2020 10:03:05 GMT cloudharmony 2020-09-28T10:03:05Z https://community.splunk.com/t5/Splunk-Search/Regex-in-search-key/m-p/101919#M26329 <P>I have a log with entries like this: region.0="us" region.1="us_west" region.2="us_west_pacific" region.3="us_ca". The order and number of the values associated with the region keys is arbitrary. I'm new to splunk. I want to query for all logs where "us_west" is assigned to any of the region keys, basically something like: region.[0-9]="us_west". Is this possible?</P> Mon, 28 Sep 2020 10:03:05 GMT https://community.splunk.com/t5/Splunk-Search/Regex-in-search-key/m-p/101919#M26329 cloudharmony 2020-09-28T10:03:05Z https://community.splunk.com/t5/Splunk-Search/Regex-in-search-key/m-p/101920#M26330 <P>Well, given your sample data, you can list them with a search like</P> <PRE><CODE>... | rex field=_raw " (?&lt;region_key&gt;[^=]+)=us_west " | ... </CODE></PRE> <P>Plese note that the initial dots indicate your base search with source/sourcetype etc, and the trailing dots indicate the stats/chart/table/whatever operations you may want to use on your newly discovered regions.</P> <P>If your log messages contain double quotes (") around the values, you would probably need to escape them with a backslash in the rex statement... I guess. I haven't tried that one.</P> <P>Hope this helps,</P> <P>Kristian</P> Tue, 01 Nov 2011 22:04:23 GMT https://community.splunk.com/t5/Splunk-Search/Regex-in-search-key/m-p/101920#M26330 kristian_kolb 2011-11-01T22:04:23Z