I have these statements I am trying to extract the "200" from, but this number could be any three digit number though.
<117>Sep 01 16:19:12 ip-10-255-55-21 SLAVE[prodr35e-core_24322]: 10-255-55-21 10-255-55-21 - 2016-09-01 16:19:12 86 GET /search?keyword=true&sortKey=4&start=2100&count=s=false&marketPlace=true HTTP/1.1 ?keyword=true&sortKey=4&start=2100&count=60&s=false&marketPlace=true 200 33687 "Jak Commons-HttpClient/3.1"
<117>Sep 01 16:19:12 ip-10-444-33-63 SLAVE[prodr35e-core_390959]: 10-444-33-634 10-444-33-65 - 2016-09-01 16:19:12 2 GET /index.html HTTP/1.0 200 1488 "-"
<117>Sep 01 16:19:12 ip-10-999-39-99 SLAVE[prodr35e-core_390959]: 10.999.39.79 10.999.39.99 - 2016-09-01 16:19:12 252 GET /search?keyword=true&count=0&sendRefinements=false&marketPlace=true&isBOPUS=true&storeId=555&storeId=592&storeId=696&storeId=548&storeId=592 HTTP/1.1 ?keyword=true&count=0&sendRefinements=false&marketPlace=true&isBOPUS=true&storeId=555&storeId=592&storeId=696&storeId=548&storeId=592 200 973 "Jak Commons-HttpClient/3.1"
<117>Sep 01 16:19:12 ip-10-200-00-00 SLAVE[prodr35e-core_489352]: 127.0.0.1 10.200.00.00 - 2016-09-01 16:19:12 0 GET /products/admin/beans?key=/select&stats=true&cat=QUERYHANDLER&wt=json HTTP/1.1 ?key=/select&stats=true&cat=QUERYHANDLER&wt=json 200 733 "Python-urllib/2.7"
<117>Sep 01 16:19:12 ip-10-204-38-110 SLAVE[prodr35e-core_497105]: 10.222.22.22 10.222.22.222 - 2016-09-01 16:19:12 41 GET /search?&count=96&start=0<l=false HTTP/1.1 ?count=96&start=0<l=false 200 6903 "Java/1.7.0_55"
I just can't seem to get my regex to work for all of these statements, help would be highly appreciated!
regex might not be what you want to use, You have several 3 digit numbers, however it seems like the data is all of a uniform format with spaces between fields. Using split you could do
eval temp=split(_raw," ") | eval status=mvindex(temp,15) | fields - temp
your search | rex field=_raw "\s(?<response>\d\d\d[^\s])" | table response
Try this
... | rex "\s(?<status>\d\d\d)\s" | table status