How to extract a numeric field with rex, then run a timechart with the max value over 5 minutes?

[sheltomt]

Hello,

I'm trying to extract a field, and then run a timechart with the max value over 5 minutes.

My extraction is strictly the tail integer of this string:

<server2name-loc-l1p.domain.com@10.10.10.10#sessions=568>

Best looking solution I found so far is:

| rex field=_raw ".*#sessions +(?<number>[0-9]+)" |timechart span="5m" max(number)

But it does nothing.

[santiagoaloi]

You can even use a shorter one:

| rex field=_raw ".*=(?\d+)"

[sheltomt · Accepted solution]

We solved it by going a whole different direction. I was fooling with a super long string, but my co-worker came up with:

rex ".*=(?P\d+)\D"

We're good!

[aljohnson_splun]

What happens if you table out the number values first ? Is your extraction working?

| rex field=_raw ".*#sessions +(?<number>[0-9]+)"
| table number