How come my rex command doesn't give results as expected?

[ananth402]

I have the following log statement and I would like to retrieve the mac address which is a 12 digit string from it.

msgType=notifications notification={"device":"mac:Ab12Cd34nm67","cam":"{\"mac\":\"Ab:12:Cd:34:nm:67\",\"Number\":\"AAAAAAAAA\",.....}"}

I tried with

 host=host* source="source.log" "msgType=notifications*" | rex "(?<mac:.{12})>"

I'm looking for the string mac:Ab12Cd34nm67. How can change the regex to obtain the expected string?

[somesoni2]

Try like this updated

 host=host* source="source.log" "msgType=notifications*" | rex "mac\:(?<mac>.{12})"

[ananth402]

There seems to be an issue with the regex statement because it shows Premature end of data in tag form line 1 when I try to use it

[somesoni2]

Yeah.. missed removing a >. Try the updated answer.

[ananth402]

tried using host=host* source="source.log" "msgType=notifications*" | rex "mac:(?<mac_number>)" | stats count by mac_number doesn't give me any results