you can't do that, because there is not
1 ADM/ADMX policies
| makeresults | eval _raw="1 ADM.ADMX policies Found ADM/ADMX policies" | multikv noheader=t | table _raw | regex "\d*\sADM\.ADMX\spolicies"
We can't answer that because that's not what you're talking about in the question and comment.
Check the results of
regex before saying there is no result of
@srinivas0704 Could you try
index=foo | regex _raw="1\s+ADM\.ADMX\spolicies" if you need to match with
1 ADM.ADMX policies literally but if you need to capture string with any digit at the start you can try with
index=foo | regex _raw="\d\s+ADM\.ADMX\spolicies"
There's a contradiction in what you want to find. Is it "1 ADM.ADMX policies" or "1 ADM/ADMX policies"? My latest response will find the latter. This should find the former: