extract valued of a field

[mmengu416]

Hi,
we have client_id=tom. client_id=thomas, client_id=Jack, client_id=tom-new, client_id=tom_old.. so on like 100s of them. for a particular query such as
index=aaa sourcetype=bbb search "my string" | stats count by client_id
I want to extract value for the field "client_id", when I try to use the "extract field" in Splunk it is picking up different values which are not the actual client_id values.
how do I write regex/rex to entract "client_id"
query to look for the "client_id" filed and display its value.

[richgalloway]

You shouldn't need to use the field extractor for key=value fields as Splunk extracts them automatically.
Can you share some actual (sanitized) events?

[gcusello]

Hi @mmengu416,
if in your logs you have client_id=tom, Splunk recognize that client_id is a field and associate tom to this field, if otherwise you have a different format (e.g. client_id: tom), you have to extract this field using regex
could you share an example of your logs?

Ciao.
Giuseppe