regex matched data only

[mkarimi]

I have a regex which looks for any event that has the repid=XXXX where XXXX is some number

"mysearch | rex repid=(?<REP_ID>\d+)"

I need to display data that only matches that criteria. for example none of these should be shown:

repid
or 
repid=
or 
repid%s20=
or
repid-1245

[yannK · Accepted solution]

Your example is not valid, please avoid the confusion between :

• the command "regex" that is used as a filter, and does not extract anything.

that would look like :

mysearch repid | regex _raw="repid=\d+"

or if the field is already extracted

mysearch repid | regex repid="\d+"

• the command "rex" that is used to define field extractions not to filter

mysearch repid | rex "repid=(?<REP_ID>\d+)"

here is a complex way to do it, but not really worth it

mysearch repid | rex "repid=(?<REP_ID>\d+)" | fillnull REP_ID value="was not found" | where REP_ID!="was not found"

[mkarimi]

got that to by using (?i) in regex _raw="(?i)repid=\d+"

[mkarimi]

awesome! thanks for the help. is it possible to make the repid in regex _raw="repid=\d+" case insensitive? the reason is that there might be some cases of RepID or repiD, etc.