Out of events, I have to pick extract <SERIAL_NUM>12456789</SERIAL_NUM>
Please help me with the REX syntax in a search.
Your extracted field will be called SerialNumber
... | rex SERIAL_NUM\>(?<SerialNumber>\d+)
rex (?\d+)
I downvoted this post because this won't work since you did not give the field a name..
also, why did you even post the question if you're going to post an incorrect answer and accept it? especially when more experienced splunkers provided you with answers that will work?
Ok, got it
rex < SERIAL_NUM >(?\d+)
@skoelpin's answer should work great but just in case the serial number has non digits as well, please try this:
your query to reurn events
| rex "\<SERIAL_NUM\>(?<serial_num>[^\<]+)\<\/SERIAL_NUM\>"
| table serial_num
Your extracted field will be called SerialNumber
... | rex SERIAL_NUM\>(?<SerialNumber>\d+)