How to extract AppId from whole text

[jw44250]

Extracting AppID(s) from whole text and group by AppId and host

txid:944::appId:3::test:

txid:944::appId:3::tes2:

txid:944::appId:4::test4:

txid:944::appId:4::tes2:

txid:944::appId:5::test4:

txid:944::appId:6::tes2:

[DalJeanis]

Try something like this...

| rex "txid:(?<txid>[^:]+)::appId:(?<appId>[^:]+)::(?<host>[^:]+):"
| stats count by appId host txid

[jw44250]

clientAppId="123123"

[jw44250]

clientAppId="123123"

[jw44250]

| rex "clientAppId(?[^=]+)"
| stats count by appId host

| rex "clientAppId=(?\d+)"
| stats count by appId host

i am not getting any result