How to extract the last three digits after the ">" sign, and than the summation of those values?

[amaralt808]

Hello,

I have a search that prints out a list of numbers in this format.

[144 ==> 143]
[145 ==> 144]
[144 ==> 145]
[145 ==> 144]
[144 ==> 145]
[143 ==> 144]
[144 ==> 143]
[143 ==> 144]
[144 ==> 143]
[143 ==> 144]
[142 ==> 143]
[143 ==> 142]
[144 ==> 143]

I want to extract the last three digits after the ">" sign.

For example, [144 ==> 143] turns into 143.

Then I want a summation of those values, so I guess I need to turn it into an int.

Here is what I have so far
rex "==>(?<regexusers>.*)"

Where regexusers is what is being saved.

Any help will be greatly appreciated!!

[somesoni2]

Try something like this

Your current search giving those numbers/text
[144 ==> 143]
| rex field=YourfieldNameHere "\>\s*(?<regexusers>\d+)"
| stats sum(regexusers) as regexusers

[ITWhisperer · Accepted solution]

| rex "==>.+?(?<regexusers>\d{1,3})\]"

[amaralt808]

I hate to ask, but could you explain the process?

| rex "==>.+?(?<regexusers>\d{1,3})\]"

rex -> Look for "==>"  

.+ -> Followed by any new character except end line. 
what does ?(? mean

<regexusers> = group i want to save it to

\d{1,3} = any digit that are 1-3 characters. 

} end group

what does \ mean?

[ITWhisperer]

You can use regex101.com to explain regex

https://regex101.com/r/hlErAZ/1 

But to answer the questions specifically, the ? reduces the unlimited + to as few characters as possible to still fit the rest of the pattern.

The \] is to anchor the pattern at the end of the digits. I used \] as ] is sometimes used as a special character, although, to be fair, in this instance, the \ isn't strictly necessary.

[somesoni2]

Regex uses backslash ( \ ) for two purposes: 1) for metacharacters such as \d (digit), \D (non-digit), \s (space), \S (non-space), \w (word), \W (non-word). 2) to escape special regex characters, e.g., \. OR \+

[amaralt808]

I love you.

It worked!