Splunk search with regex

[ss394546910]

Hi everyone, I got lots of the blow _row after the search:

........

2002-02-22 17:32:15.592 somedatainformation ==> ASH.cctv.mary.CREDITCHECK.103294384.0000

2002-02-22 13:32:15.592 somedatainformation ==> ASH.cctv.mary.CREDITCHECK.103294384.0000

2002-02-22 13:30:15.222 somedatainformation ==> ASH.cctv.mary.CREDITCHECK.103292222.0002

......

how can I just get the string after the "==>" like "ASH.cctv.mary.CREDITCHECK.103294384.0000" and remove the duplicated value?

Thanks

[venkatasri · Accepted solution]

Hi @ss394546910 

Can you try this?

<your_search> 
| rex "==\>\s(?<info>.+)" 
| dedup info
| table info

--

an upvote would be appreciated and Accept solution if this reply helps!