How to search for fields that contains number in the form of a string

[namanbharti9]

Hi All,

I'm trying to form a query for searching only specific fields, wherein there are numbers after a specific piece of text. To provide an example, I am currently using the following query:

host="xyz-*" apple "retry *"

I have to find specific entries that have this in their result: "retry 1" or "retry 2" or "retry 3" etc. up to I don't know how many retries.

But the problem that I'm facing is that the above query is also displaying results which have "retry banana", "retry mango" etc. too.

Can someone help me please?

Thanks

[thambisetty]

host="xyz-*" 
| regex _raw="retry\s\d+"

[thambisetty]

is that retry assigned to some field?

for example, if value retry 1 or retry 2 are assigned to field "retry" then you can use regex

host="xyz-*" apple 
| regex retry="retry\s\d+"

[namanbharti9]

Thanks for the reply, @thambisetty .

Unfortunately, it is not assigned to a field but is just a value in the search. Anyway, I have been able to get past this issue by leveraging some "(" brackets that were included in the search.

However, I have one more question.

I am trying to see results that contain anything but "retry 1". So I thought something along the lines of this:

host="xyz-*" apple "(retry *)" !"(retry 1)"

But as you would have guessed, it doesn't work.

How can I see all results which include "retry 2", "retry 3" and so on except "retry 1"?