How to write a Regex to extract and list out the country names from my html formatted results ?

[pavanae]

The following were my html search results

<country>USA</country>
<country>CANADA</country>
<country>UK</country>
<country>AUSTRALIA</country>

How do I write the regex to extract and list out the countries and their count.

Thanks

[masonmorales]

Assuming those are all in the same event...

| rex max_match=0 "\<country\>(?<country>[^\<]+)"

Reference: http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchReference/rex

[ishaanshekhar · Accepted solution]

First, if the search results you mentioned are separate events, then you are good. Else, you need to add this config in the Parsing Stage (Heavy Forwarder/Indexer):

props.conf:
SHOULD_LINEMERGE=false

Post that, use this regex in the search query to extract the Amount Due field and then calculate the average.

<...Initial Search...>|rex field=_raw "<country>(?< COUNTRY>.*)<\/country>"|stats count by COUNTRY as COUNTRY_COUNT

[badrinath_itrs]

Please use the code options while pasting the answer so that the page should not exclude characters such as "< "etc..

[ishaanshekhar]

thanks badrinath! I edited my answer and now it is working fine.

[tom_frotscher]

Is every line a seperated event, or are all lines united in one event?