Need help in extracting branch numbers from event message

[labaningombam]

I have a field called RenderedMessage in event log which has the following text

Task finished:  TaskID 1 for branch 6000

I have been given the task to alert in an email all the branches that has the tasked finished.

In my search, I am able to get the events for this task as

index=prod | spath RenderedMessage | search RenderedMessage="*Task finished: ColleagueNextWeekTask*"

How shall I extract only the branch values from this events/message? I need only the 6000 from this.

Thank you.

[labaningombam]

Thank you so much, @richgalloway It works. Is there a way I can display only the branch after this command without showing count. I can display it with

| stats count by branch

[richgalloway]

The table command can do that.

| table branch

[richgalloway · Accepted solution]

Use the rex command to extract a field from another field (including _raw).

| rex field=RenderedMessage "branch (?<branch>\d+)"