Why is my rex search not extracting the expected value?

[chsanth]

I have a string like this:

dps.qsz=0,dps.lck=false,dps.dis=false,dps.mx=2,dps.ac=0

Now, I want to extract dps.mx=

The current search I have is:

rex field=_raw "dps.mx=(?\d{1,2})" | table AVZE

but it's not giving the exact value 2.

Can anyone help?

[the_wolverine]

Are you sure the field doesn't already exist as dpx_mx? The automatic field extraction should find those key=value pairs in your data due to the format. And it will automatically convert the . to underscore.

If so you could just use that field or rename it to whatever you'd like:

| rename dpx_mx as dpxmx

[aljohnson_splun]

Try:

rex "dps\.mx=(?<dpsmx>\d{1,2})"

You need to escape the . earlier on, as well as name the extraction.