Splunk Search

Why is my rex search not extracting the expected value?

New Member

I have a string like this:


Now, I want to extract dps.mx=

The current search I have is:

rex field=_raw "dps.mx=(?\d{1,2})" | table AVZE

but it's not giving the exact value 2.

Can anyone help?

0 Karma


Are you sure the field doesn't already exist as dpx_mx? The automatic field extraction should find those key=value pairs in your data due to the format. And it will automatically convert the . to underscore.

If so you could just use that field or rename it to whatever you'd like:

| rename dpx_mx as dpxmx
0 Karma

Splunk Employee
Splunk Employee


rex "dps\.mx=(?<dpsmx>\d{1,2})"

You need to escape the . earlier on, as well as name the extraction.

Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!