How to extract a field from my sample log with the rex command?

[guillecasco]

I have this log:

[:|host|:] ip-10-.-666-6666225
[:|reqID|:] some id
[:|ap|:] info
{:|sum|:}
INCOMING REQUEST:
PATH: /SALT/v3/environments/xxxxxxxxxx/upsearch/
{/:|sum|:}

where each thing inside || is a field on the log. This log represents a hit from a device to some backend. I need to extract the string "xxxxxxxx" from the field sum which represents a unique device, and show in a table for a certain amount of days how many calls that device did.
How can I do this? i need a table to show every day the sum of hits for each unique device to that backend.

[somesoni2]

Try something like this (run anywhere sample)

| gentimes start=-1 | eval _raw="[:|host|:] ip-10-.-666-6666225
 [:|reqID|:] some id
 [:|ap|:] info
 {:|sum|:}
 INCOMING REQUEST:
 PATH: /SALT/v3/environments/xxxxxxxxxx/upsearch/
 {/:|sum|:}" | table _raw 
| rex "PATH:\s+\/\w+\/\w+\/\w+\/(?<DeviceID>[^\/]+)" 

Once you've extracted DeviceID, you can run your aggregation like this

your base search |"PATH:\s+\/\w+\/\w+\/\w+\/(?<DeviceID>[^\/]+)" | bucket span=1d _time | stats count by _time DeviceID

[guillecasco]

Sorry buddy, pretty new with Splunk. What does exactly does this do?

| gentimes start=-1 | eval _raw="[:|host|:] ip-10-.-666-6666225

and for the rex part

| rex "PATH:\s+\/\w+\/\w+\/\w+\/(?[^\/]+)"  

you are saying that after path any word starting with S I think, and the Ws?.

The table after all this is not a big deal, I think I got that. Just needed to know how to extract the device_id

thanks!

[somesoni2]

I should've been clear. The portion before the rex is the the code to generate sample data (from your sample event).
In the rex, \s is for space, \w is for alphanumeric character. So the DeviceID is prefixed by

"PATH:one of more spaces/one of more alphanumeric chars/one of more alphanumeric chars/one of more alphanumeric chars/(DevideID is every character from here till next '/'"