https://community.splunk.com/t5/Splunk-Search/Extracting-multiple-fields-from-a-line/m-p/198179#M57291 <P><CODE>regex</CODE> filters results, use <CODE>rex</CODE> to extract fields in a search: <A href="http://docs.splunk.com/Documentation/Splunk/6.1.1/SearchReference/rex">http://docs.splunk.com/Documentation/Splunk/6.1.1/SearchReference/rex</A></P> Fri, 13 Jun 2014 22:47:37 GMT martin_mueller 2014-06-13T22:47:37Z https://community.splunk.com/t5/Splunk-Search/Extracting-multiple-fields-from-a-line/m-p/198178#M57290 <P>I have a line that contains 2 different fields that I need </P> <P>Right now I have: <BR /> index=os sourcetype="xxx" | regex _raw="\d tests, \d assertions, \d failures, \d errors"</P> <P>Which returns for example: <BR /> 2 tests, 2 assertions, 0 failures, 0 errors</P> <P>How can I extract the fields tests and failures? would it be possible? </P> Fri, 13 Jun 2014 22:41:40 GMT https://community.splunk.com/t5/Splunk-Search/Extracting-multiple-fields-from-a-line/m-p/198178#M57290 cutenemo 2014-06-13T22:41:40Z https://community.splunk.com/t5/Splunk-Search/Extracting-multiple-fields-from-a-line/m-p/198179#M57291 <P><CODE>regex</CODE> filters results, use <CODE>rex</CODE> to extract fields in a search: <A href="http://docs.splunk.com/Documentation/Splunk/6.1.1/SearchReference/rex">http://docs.splunk.com/Documentation/Splunk/6.1.1/SearchReference/rex</A></P> Fri, 13 Jun 2014 22:47:37 GMT https://community.splunk.com/t5/Splunk-Search/Extracting-multiple-fields-from-a-line/m-p/198179#M57291 martin_mueller 2014-06-13T22:47:37Z https://community.splunk.com/t5/Splunk-Search/Extracting-multiple-fields-from-a-line/m-p/198180#M57292 <P>can you post how we can do it with rex, I'm still struggling</P> Fri, 20 Jun 2014 20:40:09 GMT https://community.splunk.com/t5/Splunk-Search/Extracting-multiple-fields-from-a-line/m-p/198180#M57292 cutenemo 2014-06-20T20:40:09Z https://community.splunk.com/t5/Splunk-Search/Extracting-multiple-fields-from-a-line/m-p/198181#M57293 <P>the number actually comes before \d tests</P> Fri, 20 Jun 2014 20:41:39 GMT https://community.splunk.com/t5/Splunk-Search/Extracting-multiple-fields-from-a-line/m-p/198181#M57293 cutenemo 2014-06-20T20:41:39Z https://community.splunk.com/t5/Splunk-Search/Extracting-multiple-fields-from-a-line/m-p/198182#M57294 <P>Can you post some sample logs? Based on that people will be able to help you with field extractions.</P> Fri, 20 Jun 2014 20:55:19 GMT https://community.splunk.com/t5/Splunk-Search/Extracting-multiple-fields-from-a-line/m-p/198182#M57294 somesoni2 2014-06-20T20:55:19Z https://community.splunk.com/t5/Splunk-Search/Extracting-multiple-fields-from-a-line/m-p/198183#M57295 <P>I'm guessing this:</P> <PRE><CODE>... | rex "(?&lt;tests&gt;\d+) tests, (?&lt;assertions&gt;\d+) assertions, (?&lt;failures&gt;\d+) failures, (?&lt;errors&gt;\d+) errors" </CODE></PRE> <P>However, without seeing your actual events that's only that, a guess.</P> Fri, 20 Jun 2014 20:57:58 GMT https://community.splunk.com/t5/Splunk-Search/Extracting-multiple-fields-from-a-line/m-p/198183#M57295 martin_mueller 2014-06-20T20:57:58Z