not sure i fully understand the question, but would you be looking to do something like this? ... | stats count by host | eval verbose="Apache host ".host." has ".count." errors" | table verbose or if "Apache host hostname has count errors" is your input you could do ... | rex "Apache host (?[^\s]+) has (?\d+) errors" | table hostname, count ... View more

I had a case open with Splunk support on this, and was told it was a potential defect in the UI. I worked around it; you could use \w{3}\d\d?\d?\w instead of \w{3}\d{1,3}\w Clunky, but it works... ... View more

are you looking to do any operation, or would it always be sum? | eval str="1+2" | rex field=str "(?\d+)+(?\d+)" | eval sum=A+B identifying the operator would make it more complicated, but it could probably be done... ... View more

Maybe something like this, as long as the only parens are the ones around the username? rex "\((?<username>[^\)]*)\)" ... View more

Thank you, that was driving me crazy! ... View more