Hi, I'm trying to make a Splunk panel display a value from a log that gets added to every 4 minutes. I need to be able to see on the dashboard if the value suddenly drops. I've tried extracting the value, but it keeps messing up. Should I use regex, or do I need to extract it in a different way? My goal is to only get the value after "value= " to return. This is how the data looks when it's imported into Splunk, each new line is a single event: 2020-05-14T13:39:28.423Z, machine= wefqwr2312, value= 14 2020-05-14T13:40:29.003Z, machine= wefqwr2312, value= 14 2020-05-14T13:40:29.118Z, machine= wefqwr2312, value= 14 2020-05-14T13:41:28.316Z, machine= wefqwr2312, value= 14 2020-05-14T13:41:28.323Z, machine= wefqwr2312, value= 14 2020-05-14T13:45:48.032Z, machine= wefqwr2312, value= 14 2020-05-14T13:45:48.041Z, machine= wefqwr2312, value= 14 Thanks! ... View more

I'm trying to only extract the value of 'value' with regex. 2020-03-04 12:14:26,363 - measurement:34- sensor=43, value="0.034051", date="None" I've tried this but it didn't work: | rex field=value "(?<myValue>\d{3})" | search myValue=* Where did it go wrong and how do I solve this? ... View more