Why is Regex not displaying results?

[amitrinx]

Hi
I have a key named
ick=2c27194g-af5e-4f7d-9847-07cd5c4c70af 

Want to search all the ick using regex 
I tried 
regex ick="="([a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})""

It is not giving any results.
Can some one help?

[gcusello]

Hi @amitrinx,

could you share some complete log sample, without it it's difficoult to help you.

Anyway, the regex from @yuanliu seems to be correct and you could try to use it.

Ciao.

Giuseppe

[yuanliu · Accepted solution]

if, by

I have a key named
ick=2c27194g-af5e-4f7d-9847-07cd5c4c70af 

you mean that whole string is part of a raw event, you need

| regex "ick=([a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})"

to pick it out.

If, on the other hand, you mean that you have a field named "ick" that Splunk populates with that value, but in raw events they are not in the form of "key=value", you need to follow the actual format.