I have a query statement like so
index=* "account balance:" | rex "blah blah account balance:(?P<balance>(\d{1,3}(,\d{3})*)+) " | table balance
And this works fine, but when I try to add `latest` In there, it gives no results.
index=* "account balance:" | stats latest() | rex "blah blah account balance:(?P<balance>(\d{1,3}(,\d{3})*)+) " | table balance
Why am I not able to perform regex on the latest event?
sample:
index=_internal | head 2
| rex "(?P<balance>(\d{1,3}(,\d{3})*)+)" | table balance
| eval note="no_stats"
| append [ search index=_internal | head 2 |stats latest(_time) as _raw
| rex "(?P<balance>(\d{1,3}(,\d{3})*)+)" | eval note="default_latest"]
| append [ search index=_internal | head 2 |stats latest(_time) as test
| rex field=test "(?P<balance>(\d{1,3}(,\d{3})*)+)" | eval note="rename_latest"]
rex extracts fields in _raw by default. try field= option.