Extracting values inside of a [] , which are , separated with spaces

[RamMur]

trying to use rex to get the contents for the field letterIdAndDeliveryIndicatorMap.

For example, Logged string letterIdAndDeliveryIndicatorMap=[abc=P, efg=P, HijKlmno=E]

I want to extract the contents between the [] , which is abc=P, efg=P, HijKlmno=E and then find stats on them.

I was trying something like 

rex  field=_raw "letterIdAndDeliveryIndicatorMap=\[(?<letterIdAry>[^\] ]+)"

but, its not working as expected.

Thanks in advance!

[yuanliu]

As @ITWhisperer says, "not working as expected", "doesn't work", etc., should be forbidden in this forum.  More specifically, if your raw events contain things like "letterIdAndDeliveryIndicatorMap=[abc=P, efg=P, HijKlmno=E]", Splunk's default extraction should have given you abc, efg, HijKlmlo without you asking. (It also gives you a field letterIdAndDeliveryIndicatorMap.) If you do table *, what do you see?

Here is an emulation

| makeresults
| eval _raw="letterIdAndDeliveryIndicatorMap=[abc=P, efg=P, HijKlmno=E]"
| extract

 

[RamMur]

yes, found that my regex had a space between ]], once fixed, was able to extract them as "abc=P, efg=P, HijKlmno=E" , thanks. next trying to get stats on count of abc=P.

[dtburrows3]

You should be able to use the split function after extracting which will convert it to a MV field and then utilize a stats against that MV field.
Something like this

<base_search>
    | rex field=_raw "letterIdAndDeliveryIndicatorMap=\[(?<letterIdAry>[^\]]+)"
    | eval
        letterIdAry=split(letterIdAry, ","),
        letterIdAry=case(
            mvcount(letterIdAry)==1, trim(letterIdAry, " "),
            mvcount(letterIdAry)>1, mvmap(letterIdAry, trim(letterIdAry, " "))
            )
    | stats
        count as event_count
            by letterIdAry

Example output:

[ITWhisperer]

What do you mean by "not working as expected" (because it looks like you should have extracted something at least)?