Need help to create a regular expression

[Mrig342]

Hi All,

I am trying to create a regular expression to extract a value from a given log. Below is the log:

2021-10-05 07:25:42.986, DATUM2="3095", STATUS="2", REQUEST_TYPE="103", PRIORITY="300", OWNER="490070", COUNT(1)="2"

Here I want to extract value of "COUNT(1)" and created the regular expression (?ms)COUNT\(1\)\=\"(?P<COUNT(1)>\d+)\"

But with this expression I am not able to get the field name as "COUNT(1)" which is my requirement.

Please help modify my expression to get the desired output.

Thank you very much.

[ITWhisperer · Accepted solution]

| makeresults
| eval _raw="2021-10-05 07:25:42.986, DATUM2=\"3095\", STATUS=\"2\", REQUEST_TYPE=\"103\", PRIORITY=\"300\", OWNER=\"490070\", COUNT(1)=\"2\""
| rex "(?ms)COUNT\(1\)\=\"(?P<COUNT_1>\d+)\""
| rename COUNT_1 as "COUNT(1)"

[Mrig342]

Thank you so much ITWhisperer..!!

Your solution is perfect for my requirement. I wonder why it didn't hit my mind.. Haha..

[PickleRick]

https://www.pcre.org/current/doc/html/pcre2pattern.html#SEC16https://www.regular-expressions.info/na...

In PCRE2, a capture group can be named in one of three ways: (?<name>...) or (?'name'...) as in Perl, or (?P<name>...) as in Python. Names may be up to 32 code units long. When PCRE2_UTF is not set, they may contain only ASCII alphanumeric characters and underscores, but must start with a non-digit. When PCRE2_UTF is set, the syntax of group names is extended to allow any Unicode letter or Unicode decimal digit. In other words, group names must match one of these patterns:

  ^[_A-Za-z][_A-Za-z0-9]*\z   when PCRE2_UTF is not set
  ^[_\p{L}][_\p{L}\p{Nd}]*\z  when PCRE2_UTF is set

 In other words, you can't directly capture as group named "count(1)". You might capture with another name and rename the field later.

[Mrig342]

Thank you very much PickleRick..!!