Regex in search key

[cloudharmony]

I have a log with entries like this: region.0="us" region.1="us_west" region.2="us_west_pacific" region.3="us_ca". The order and number of the values associated with the region keys is arbitrary. I'm new to splunk. I want to query for all logs where "us_west" is assigned to any of the region keys, basically something like: region.[0-9]="us_west". Is this possible?

[kristian_kolb]

Well, given your sample data, you can list them with a search like

... | rex field=_raw " (?<region_key>[^=]+)=us_west " | ...

Plese note that the initial dots indicate your base search with source/sourcetype etc, and the trailing dots indicate the stats/chart/table/whatever operations you may want to use on your newly discovered regions.

If your log messages contain double quotes (") around the values, you would probably need to escape them with a backslash in the rex statement... I guess. I haven't tried that one.

Hope this helps,

Kristian