I am trying to select numbers from a field using Rex, but I cannot seem to figure it out.
Basically the values that i have in the field are:
I want to be able to select the number in the () - this number can be of any length.
How can I do this?
|rex field=<fieldname> "\((?<number>\d+)"
try this run anywhere search:
|makeresults|eval sample="XX (432)"|rex field=sample "\((?<number>\d+)"