how to use regression expression to extract a field

[hqw]

hi all,

i have one filed called value, it is a value like : 1006718, but it contains two information, 10067 is the real score, 18 is another filed called steps. May i know how can I separate this value into two fields, one is called real_value, another is called move_steps?

my search:
(label="Score*") value |stats count(_raw) by value |rename value AS Score

my result:
Score

1006718

[echalex · Accepted solution]

Hi,

This regular expression is only valid if the value of steps always corresponds to the last two digits of value:

... |rex field=value "^(?<score>\d*)(?<steps>\d\d)$" 

If steps can consist of one digit or more than two digits, then you can only guess.

[hqw]

Hi echalex,

Thanks for your help, it really works.

Best Regards
hqw

[vincenteous]

Does the value have fixed format (in your example it's 7 digits format)?