Regex

[nathanluke86]

Hi,

I am trying to find unique id's the have 3 letters followed by 6 numbers for example

bhg111111

My issue is I want to not count duplicates and would like to do this within the regex itself (not dedup by field.

is this possible

thanks,

[493669]

Hi @nathanluke86 

You can use Stats like below-

...|stats count by fieldname

 Here It will give Unique values of fieldname with count and If count is not required you can remove it using 

|fields - count

[ITWhisperer]

So still not completely within the rex (which I am not sure you could do anyway) and based @493669 suggestion

--- your search
| rex field=yourfield max_match=0 "(?<id>[a-zA-Z]{3}\d{6})"
| stats count by id
| fields - count

[nathanluke86]

hi @ITWhisperer 

yes thats exactly what I am trying to achieve,

Kind regards,

[ITWhisperer]

Hi @nathanluke86 

Why do you not want to use dedup, it does what you need to do a lot easier than trying to write some complicated alternative?

[ITWhisperer]

Just to clarify, your field could contain multiple occurrences of this pattern and you want to count the unique occurrences but you don't want to use dedup?

bhg111111 bhg111111 bhg222222 is two matches?