Rex to select number from string

[abbam]

Hi All,

I am trying to select numbers from a field using Rex, but I cannot seem to figure it out.

Basically the values that i have in the field are:

XX (432)
FH02 (2356)
YR01 (855553)

I want to be able to select the number in the () - this number can be of any length.

How can I do this?

Thanks!

[mayurr98 · Accepted solution]

You can try something like this

<your base search> | rex field=<fieldname> "\s\((?<number>[^\)]+)"

let me know if this helps!

[mayurr98]

try this if the field is multivalue

| rex field=<fieldname> max_match=0 "\s\((?<number>[^\)]+)"

[abbam]

thank you! worked perfectly!

[493669]

Hi @abbam,
try this:

|rex field=<fieldname> "\((?<number>\d+)"

try this run anywhere search:

|makeresults|eval sample="XX (432)"|rex field=sample "\((?<number>\d+)"

[abbam]

Thank you!

How would you do it if the field was multivalue?