Extracting values from a field

[ibekacyril]

I have 2 fields like these:

For Field 1:
type=Intelligence

Field 2:
[abcd=[type=High] [Number=3309934] ]

I know I can search by type but there is another field named also named type so if I do

| ...stats count by type

I would get:

Intelligence

How do I specifically extract High from Field 2 (Typing High in the search is not an option because you could have type=Small

Also, using this code:

| ...stats count by abcd

produces : type=High

I only want to see High and not "type="
If you can provide a workable solution either using rex and eval or another code, it would be appreciated.

Thanks in advance

[chimell]

Hi
try this search code

............................. | rex  field=_raw  "/[abcd/=/[type/=(?<Type>[^\/]]+)" | stats count by Type

[ibekacyril]

Thanks for your help

[lguinn2 · Accepted solution]

Try this:

yoursearchhere
| rex field=abcd "=\[type=(?<new_type>.*?)\]"
| stats count by new_type
| rename new_type as type

This should give you a field named "new_type." It is best if you pick a different field name, otherwise Splunk will merge all the field definitions. I renamed it at the end. This also assumes that what you want is part of the existing field "abcd".

[lguinn2]

If the above doesn't work, try this:

 yoursearchhere
 | rex  "=\[type=(?<new_type>.*?)\]"
 | stats count by new_type
 | rename new_type as type

or this

 yoursearchhere
 | rex  "\=\[type\=(?<new_type>.*?)\]"
 | stats count by new_type
 | rename new_type as type

I did make typo in the original answer, which I have now fixed. It is stats not stat! I still don't see anything wrong witn the original regular expression, but maybe someone else will...

[ibekacyril]

Thanks for your help