Why am I Not able to fetch record Count?

[aditsss]

Hi Team,

Below are my raw logs:

2023-08-08 10:25:13.067 [INFO ] [Thread-3] CollateralProcessor - Server side call completed for Collateral with record count:   476

2023-08-08 09:56:03.777 [INFO ] [Thread-3] CollateralProcessor - Server side call completed for Collateral with record count:  18541701

I am using below query to fetch the number

index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-transform/logs/gfp-settlement-transform.log" "Server side call completed for Collateral with record count"| rex "Server side call completed for Collateral with record count :(?<record>\d+)"|timechart span=1d values(record) AS RecordCount

I am not getting record count just date. Can someone guide here

[richgalloway · Accepted solution]

Regular expressions must be precise.  A misplaced space or two, while insignificant to a human, may make the difference between a matching event and a non-matching event.  Try this rex command in place of the original.

| rex "Server side call completed for Collateral with record count:\s+(?<record>\d+)"