rex search not extracting correctly

[RobKelley06]

I am trying to extract 2 fields out of the result, but it keeps grabbing the wrong values.

Example result:
123456789:17:05:18.865;1234;12345678;SRS;80;null;0;0;1

I want to extract the "80" and the "null" fields.  I have tried the following:

| rex field=_raw "([^;]*;){4}(?<Code>;)(?<Error>;)([^;]*;){2}"
| rex field=_raw "([^;]*;){3}(?<Code>;)(?<Error>;)([^;]*;){2}"
| rex field=_raw "([^;]*;)([^;]*;)([^;]*;)([^;]*;)(?<Code>;)(?<Error>;)([^;]*;){2}"
| rex field=_raw "([^;]*;)([^;]*;)([^;]*;)(?<Code>;)(?<Error>;)([^;]*;){2}"
| rex field=_raw "([^;]*;)([^;]*;)([^;]*;)([^;]*;)(?<Code>;)(?<Error>;)([^;]*;)([^;]*;)"
| rex field=_raw "([^;]*;)([^;]*;)([^;]*;)(?<Code>;)(?<Error>;)([^;]*;)([^;]*;)([^;]*;)"

Every time the "Code" value is coming as "null" and not "80".  What am I missing?

[bowesmana · Accepted solution]

See this search

| makeresults
| eval _raw="123456789:17:05:18.865;1234;12345678;SRS;80;null;0;0;1"
| rex field=_raw "(([^;]*);){4}(?<Code>\d+);(?<Error>[^;]*)"

I think you have missed the way you define extractions, e.g. you are using

(?<Code>;)

which is effectively saying that (if the whole rex expression matches, then the Code field will become a semi-colon.

See in my search above, where it does

(?<Code>\d+)

That is saying that the 1 or more digits (\d+) is captured by the Code field and

(?<Error>[^;]*)

is capturing all characters up to the next ; character.

Hope this helps

I am assuming from your attempts that the SRS may not always be SRS. If it's always SRS, then 

| rex field=_raw "SRS;(?<Code>\d+);(?<Error>[^;]*)"

would also work, but from your attempts, I understand that it's the 5th and 6th semi-colon separated segments you are after.