Rex query

[harishnpandey]

For below input I tried search query as

index=myindex "Notification"|rex "(MQ) (?\d+) = (?\w+)"|stats count(Notification)
However, its not working says "no result found". The moment I take off ==> stats count(Notification)
it shows values

Input:
[7/18/17 11:21:36:434 EDT] 00004b1d SystemOut O Notification Type (MQ) = EMAIL
[7/18/17 11:21:36:434 EDT] 00004b1d SystemOut O Notification Type (MQ) = SMS
[7/18/17 11:21:36:434 EDT] 00004b1d SystemOut O Notification Type (MQ) = VOICE
Output

Notification Type TypeCode
MQ EMAIL
MQ SMS
MQ VOICE

[DalJeanis · Accepted solution]

Okay, reading what I can read, i don't see why it would succeed.

Your rex is looking for a decimal number after (MQ) and before the =, which is not in your data.

Something like this should pull the two fields...

| rex "Notification Type \((?<NotifType>[^\)]*)\) = (?<TypeCode>\w+)"

[harishnpandey]

Thank you Jean. I figured out my mistake with your help 🙂

[somesoni2]

You query is truncated. Please edit the question to add the query again and ensure that you select the query and click on button "101010" OR press Ctrl+K to format the code (to retains all formatting/content). Do the same for your raw data and output