Proper REX command

[tb5821]

What would the proper REX command be to extract the following:

SPACE:SPACE then a numeric string

so ends up being ' : 949495'

[amit_saxena]

Hi,

The regular expression rex "(?i)(?P<var> : [0-9]+)$" extracts space followed by a colon and then a space and then series of digits in the end of the line. If you just want to extract only the digit, then you should use the regular expression rex "(?i) : (?P<var>[0-9]+)$" .

Let me know if it works for you this time.

Note : Hopefully the characters in my regular expression should not get truncated.

Regards,
Amit Saxena

[amit_saxena]

Hi,

Let me know if the my latest suggested solution to both the scenarios work for you.

Regards,
Amit Saxena

[amit_saxena]

Hi

Putting the expression inside a code block.

rex "(?i)(?P<var> : [0-9]+)$"l

Hopefully this time, there are no characters that gets truncated

Let me know if it works for you

Regards,
Amit Saxena

[amit_saxena]

The characters in my post are truncated. I will try to post my answer as reply to the post instead of the comment.

[amit_saxena]

Hi,

rex "(?i)(?P : [0-9]+)$" will extract both the spaces including the colon character and then the digit. If you want to extract only the digit, then you should use rex "(?i) : (?P[0-9]+)$" .

Let me know if it works for you.

Note : Hopefully the character are not truncated from my regular expression while submitting the post.

Regards,
Amit Saxena

[tb5821]

Still getting the ':'

var= : 8134038

[amit_saxena]

Hi,

Let me know how following works for you.

rex "(?i)(?P<var> : [0-9]+)$"

Regards,
Amit Saxena

[tb5821]

can you put it in a code block?

[amit_saxena]

Still the characters in my post are getting truncated and I don't know why 😞

[amit_saxena]

Let me know if this works.

rex "(?i)(?P : [0-9]+)$"

[amit_saxena]

Hi,

Try the following regular expression.

rex "(?i)(?P<var> : [0-9]+)$"

Note : Please add "< var >" ( without spaces and quotes ) after "?P" in the regular expression. Due to some issue, the "<" and ">" characters are getting truncated from my post.

Regards,
Amit Saxena

[amit_saxena]

Wait ! no matter I put correct answer, some characters are getting truncated when I submit the post ! I am posting the answer again in "post your answer" section.

[amit_saxena]

Oh ! That was a typo from my side. Try the following and let me know the outcome.

rex "(?i)(?P : [0-9]+)$"

[tb5821]

Error in 'rex' command: Encountered the following error while compiling the regex '(?i)(?P : [0-9]+)$': Regex: unrecognized character after (?P

[alacercogitatus]

Any regex tutorial would have the regex. This one only extracts the digits.

your_search | rex field=_raw "\s:\s(?<extracted>\d+)"

[alacercogitatus]

A better sample of data would help with the regex.

[Ayn]

It's basically what's in alacer's initial answer but you add the $ at the end. You may not know regex but reading through the answers and comments should give you some idea anyway.

[tb5821]

Not sure how to do that and ensure it still matches on ' : 949495'

[Ayn]

If you don't want to include the string matched by \s:\s, just leave it out of the matching group.

[Ayn]

Which decimal?