https://community.splunk.com/t5/Splunk-Search/Regular-expression-in-Datamodel-attribute/m-p/149833#M41936 <P>Wow.</P> <P>I've removed the quotes and it started working.</P> Thu, 11 Dec 2014 18:43:22 GMT snemiro_514 2014-12-11T18:43:22Z https://community.splunk.com/t5/Splunk-Search/Regular-expression-in-Datamodel-attribute/m-p/149832#M41935 <P>Hi splunkers,</P> <P>I need to create a new attribute in one datamodel. I think I don't understand the syntax or what's going on.</P> <P>The field tranID contains two letters and a number (FR82734, WR293482) . I need a new field auxTranID containing only the number portion...so this is what I did:</P> <P>In the search box:</P> <P>| datamodel DATATEST TRAN search | rex field="TRAN.tranID" (? New FIELD NAME BETWEEN ANGLE BRACKETS \d+)"</P> <P>Then I have a new field auxTranID with the proper numeric value.</P> <P>If I go to the add attribute feature in the datamodel definition and I add a rex expression selecting the field tranID and writting "(? New FIELD NAME BETWEEN ANGLE BRACKETS \d+)" in the regex field, I don't see the new field in the object.</P> <P>What am I doing wrong?</P> <P>Thanks!</P> Thu, 11 Dec 2014 18:02:15 GMT https://community.splunk.com/t5/Splunk-Search/Regular-expression-in-Datamodel-attribute/m-p/149832#M41935 snemiro_514 2014-12-11T18:02:15Z https://community.splunk.com/t5/Splunk-Search/Regular-expression-in-Datamodel-attribute/m-p/149833#M41936 <P>Wow.</P> <P>I've removed the quotes and it started working.</P> Thu, 11 Dec 2014 18:43:22 GMT https://community.splunk.com/t5/Splunk-Search/Regular-expression-in-Datamodel-attribute/m-p/149833#M41936 snemiro_514 2014-12-11T18:43:22Z