Solved: Need help with REX after a String - Splunk Community

Dashboards & Visualizations

Hi Team,

I am trying to extract the value after a particular string format and its not getting the right value.

The Value i wanted is after this string "COUNT(1)=*"

{ORD_CRTN_DTE=XXXXXXXX, COUNTRY=XXXXXX, AGENCY=XXXXXXX, PGM_CDE=XXXXXXX, COUNT(1)=1}]

I am using the the below rex and its not giving the value of the count i.e 1. The Rex I am using is below.

rex "COUNT(1)=(?<Count>\d+)"

1 Solution

Solution

You were *so* close. Literal parentheses need to be escaped in regular expressions. Otherwise, they're treated as a capture group.

| rex "COUNT\(1\)=(?<Count>\d+)"

---
If this reply helps you, Karma would be appreciated.

View solution in original post

Solution

You were *so* close. Literal parentheses need to be escaped in regular expressions. Otherwise, they're treated as a capture group.

| rex "COUNT\(1\)=(?<Count>\d+)"

---
If this reply helps you, Karma would be appreciated.

Thanks a lot Rich 🙂

Get Updates on the Splunk Community!

Unlocking Unified Insights: New Gigamon Federated Search App for Splunk

In today’s data-heavy environment, organizations are caught in a data distribution dilemma. As data volumes ...

GA: New Data Management App in Splunk Platform

Streamlining Data Management: Introducing a unified experience in Splunk Managing data at scale shouldn’t feel ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...