I hope this is an easy one where i am just missing some login somewhere.
I have a field called errors that houses data that looks like this:
This is indicating that a single event can incur multiple errors and i need to pull all the error codes separately (codes are always numerical and always 5 digits long).
The colon and digits after indicate count volumes which are irrelevant and the delimiter is always a semi-colon.
This seems quite an easy pull as the rex is simply "(\d\d\d\d\d):"
However i can't get splunk to spit anything out at all (and ive tried lots of variations).
Ideally i want to stats value the result by user so i end up with something like the below: