How to write the regular expression to extract this field with rex?

[sravankaripe]

Out of events, I have to pick extract <SERIAL_NUM>12456789</SERIAL_NUM> Please help me with the REX syntax in a search.

[sravankaripe]

rex (?\d+)

[skoelpin]

I downvoted this post because this won't work since you did not give the field a name..

also, why did you even post the question if you're going to post an incorrect answer and accept it? especially when more experienced splunkers provided you with answers that will work?

[sravankaripe]

Ok, got it

[sravankaripe]

rex < SERIAL_NUM >(?\d+)

[gokadroid]

@skoelpin's answer should work great but just in case the serial number has non digits as well, please try this:

your query to reurn events
| rex "\<SERIAL_NUM\>(?<serial_num>[^\<]+)\<\/SERIAL_NUM\>"
| table serial_num

[skoelpin · Accepted solution]

Your extracted field will be called SerialNumber

... | rex SERIAL_NUM\>(?<SerialNumber>\d+)