https://community.splunk.com/t5/Splunk-Search/How-to-write-a-Regex-to-extract-and-list-out-the-country-names/m-p/266723#M80198 <P>Please use the code options while pasting the answer so that the page should not exclude characters such as "&lt; "etc.. </P> Thu, 08 Oct 2015 10:22:04 GMT badrinath_itrs 2015-10-08T10:22:04Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-Regex-to-extract-and-list-out-the-country-names/m-p/266720#M80195 <P>The following were my html search results</P> <P>&lt;country&gt;USA&lt;/country&gt;<BR /> &lt;country&gt;CANADA&lt;/country&gt;<BR /> &lt;country&gt;UK&lt;/country&gt;<BR /> &lt;country&gt;AUSTRALIA&lt;/country&gt;</P> <P>How do I write the regex to extract and list out the countries and their count.</P> <P>Thanks </P> Thu, 08 Oct 2015 03:48:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-Regex-to-extract-and-list-out-the-country-names/m-p/266720#M80195 pavanae 2015-10-08T03:48:26Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-Regex-to-extract-and-list-out-the-country-names/m-p/266721#M80196 <P>Is every line a seperated event, or are all lines united in one event?</P> Thu, 08 Oct 2015 08:10:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-Regex-to-extract-and-list-out-the-country-names/m-p/266721#M80196 tom_frotscher 2015-10-08T08:10:07Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-Regex-to-extract-and-list-out-the-country-names/m-p/266722#M80197 <P>First, if the search results you mentioned are separate events, then you are good. Else, you need to add this config in the Parsing Stage (Heavy Forwarder/Indexer):</P> <P>props.conf:<BR /> SHOULD_LINEMERGE=false</P> <P>Post that, use this regex in the search query to extract the Amount Due field and then calculate the average.</P> <PRE><CODE>&lt;...Initial Search...&gt;|rex field=_raw "&lt;country&gt;(?&lt; COUNTRY&gt;.*)&lt;\/country&gt;"|stats count by COUNTRY as COUNTRY_COUNT </CODE></PRE> Thu, 08 Oct 2015 09:45:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-Regex-to-extract-and-list-out-the-country-names/m-p/266722#M80197 ishaanshekhar 2015-10-08T09:45:47Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-Regex-to-extract-and-list-out-the-country-names/m-p/266723#M80198 <P>Please use the code options while pasting the answer so that the page should not exclude characters such as "&lt; "etc.. </P> Thu, 08 Oct 2015 10:22:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-Regex-to-extract-and-list-out-the-country-names/m-p/266723#M80198 badrinath_itrs 2015-10-08T10:22:04Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-Regex-to-extract-and-list-out-the-country-names/m-p/266724#M80199 <P>thanks badrinath! I edited my answer and now it is working fine.</P> Thu, 08 Oct 2015 11:46:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-Regex-to-extract-and-list-out-the-country-names/m-p/266724#M80199 ishaanshekhar 2015-10-08T11:46:56Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-Regex-to-extract-and-list-out-the-country-names/m-p/266725#M80200 <P>Assuming those are all in the same event...</P> <PRE><CODE>| rex max_match=0 "\&lt;country\&gt;(?&lt;country&gt;[^\&lt;]+)" </CODE></PRE> <P>Reference: <A href="http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchReference/rex">http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchReference/rex</A></P> Thu, 08 Oct 2015 18:22:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-Regex-to-extract-and-list-out-the-country-names/m-p/266725#M80200 masonmorales 2015-10-08T18:22:48Z