How to create a rex string with "#" sign?

[jianyu75074]

I have data

2018-07-23 21:00:54##7049015762##358479078622895##2##4000######N##ABS##|##USER_NUMBER##QUERY##1##90864

I want exact user=7049015762; number=90864,
I can use mvindex:

| eval user=mvindex(split(_raw,"##"),1)| eval number=mvindex(split(_raw,"##"),-1)

But I prefer rex if possible, thanks! (is rex more effective than mvindex?)

[niketn · Accepted solution]

@jianyu75074, try the following rex command

 <yourBaseSearch>
| rex "^[^\#]+\#\#(?<user>[^\#]+)+\#\#.*\#\#(?<number>\d+)$"

Following is a run anywhere search based on the sample data provided:

| makeresults
| eval _raw="2018-07-23 21:00:54##7049015762##358479078622895##2##4000######N##ABS##|##USER_NUMBER##QUERY##1##90864"
| rex "^[^\#]+\#\#(?<user>[^\#]+)+\#\#.*\#\#(?<number>\d+)$"