Extract field from another dynamic field

[thenormalone]

I have a field from the search query called source which has a pattern of "text:text:text:dynamicText:dynamicText:dynamicText"

where text->hardcoded values and dynamicText->keeps changing for different logs.

I want to extract the 2nd dynamic text as its own field and then perform a stats count on that field. 

I'm not able to figure out how to navigate over the 1st dynamic field using regular expressions

[richgalloway · Accepted solution]

You can use rex to extract the second dynamicText and then use the stats command to count them.

index=foo
| rex "(?:[^:]+:){4}(?<dynamicText2>[^:]+)"
| stats count by dynamicText2

[thenormalone]

@richgalloway  so this is a result from one of the indexers from which I extract this dynamic field while another indexer already has the field in its search. So how do I go about combining them?

I tried renaming the dynamic field (eg: "source") which I extract from the 1st indexer with the same name as the field from the search result of the other indexer (also named "source") but when I do "| stats count source", it shows up as two different results even though the name of the source is the same. 

[thenormalone]

there was a typo in my search, it did combine the results