What would be the regular expression when using rex to match fields that end with a range of values?

[dzyfer]

What would be the regular expression when using rex to match fields that end with a range of values?

Sample:
"var0":0,"var1":10,"var2":20,"var10":100

I would like to extract fields from var1 to var10, and exclude var0.

Thanks

[bowesmana]

A search time extraction if extract does not do what you want is (from rex statement onwards - first two lines create your sample)

| makeresults
| eval _raw="\"var0\":0,\"var1\":10,\"var2\":20,\"var10\":100"
| rex max_match=0 "\"(?<key>var[1-9]\d*)\":(?<value>[^,]*)"
| foreach 0 1 2 3 4 5 6 7 8 9 [ eval k=mvindex(key, <<FIELD>>), v=mvindex(value, <<FIELD>>), {k}=v ]
| fields - key value k v

[yuanliu]

Regex is not needed for this kind of format; extract, aka kv, is sufficient.  If this is in _raw, simply do

| kv kvdelim=":" pairdlim=","

 If it is in a field named "data", you can do

| rename _raw AS temp, data AS _raw
| kv kvdelim=":" pairdlim=","​
| rename _raw as data, temp AS _raw