Hi,
I am trying to find unique id's the have 3 letters followed by 6 numbers for example
bhg111111
My issue is I want to not count duplicates and would like to do this within the regex itself (not dedup by field.
is this possible
thanks,
You can use Stats like below-
...|stats count by fieldname
Here It will give Unique values of fieldname with count and If count is not required you can remove it using
|fields - count
So still not completely within the rex (which I am not sure you could do anyway) and based @493669 suggestion
--- your search
| rex field=yourfield max_match=0 "(?<id>[a-zA-Z]{3}\d{6})"
| stats count by id
| fields - count
Why do you not want to use dedup, it does what you need to do a lot easier than trying to write some complicated alternative?
Just to clarify, your field could contain multiple occurrences of this pattern and you want to count the unique occurrences but you don't want to use dedup?
bhg111111 bhg111111 bhg222222 is two matches?