I cannot use any of this in extract (Splunk item Total: [ 0=233 ],Splunk item Total: [ 1=220 ],Splunk item Total: [ 1=220 3=40 ],Splunk item Total: [ 0=50 1=210 3=30 ],Splunk item Total: [ 0=100 1=205 2=10 3=5 ]) as I have mentioned it is not constant it changes, logs sometime display Splunk item Total: [ 0=233 ] or Splunk item Total: [ 1=220 ] or Splunk item Total: [ 1=220 3=40 ] or Splunk item Total: [ 0=50 1=210 3=30 ] or Splunk item Total: [ 0=100 1=205 2=10 3=5 ] Only think I am interested is if it had "0=" than like to extract that value if it display "1=" than like to extract that value if it display "0=" and "1=" than like to extract both value ... View more

Sorry I confuse you, actually log is printing sometime this  Splunk item Total: [ 0=233 ] or sometime this  Splunk item Total: [ 1=220 ] and looking for a regex that capture in variable "zero" value 233 and in variable "one" value 220 than I will use variable "zero" and "one  to print line graph  ... View more