REX question.

[fotc1969]

Hello, I'm having a really hard time pulling the status code from an HA proxy log using a rex command. there are a number of reasons i cant use field extraction that i don't want to go into, but just know that i cant. Im only trying to figure out how to create regex that can match the following examples:

0/0/0/179/179 200 611 - -
0/0/0/11/66 200 103092 - -
0/0/0/9/9 200 44487 - -

Notice that everything around the status code varies, but the pattern remains the same.

here's my best attempt:

| rex field=logMessage "^(?:[^/\n]*/){7}\d+\s+(?P\d+)"

but it's missing several examples. how can i make it better?

[PowerPacked · Accepted solution]

Use this Rex to extract

This splunk answers page will replace the fieldname in between REX, so adding up the image

Thanks