I have a key called message Inside the value are several results but I need to only extract one result in the middle of the results. Sample: message:  template: 1234abcd, eeid: 5678efgh, consumerid: broker My rex is below but returns the template value but also the results for eeid  and consumerid when I only need the template value of 1234abcd. | rex field=message "template: (?<TemplateID>[^-]+)" ... View more

I am looking to sum up cumulative column totals by hour in a separate column. Here is the search: index=main CompletedEvent | bin _time span=1h | stats dc(clientid) as HourlyClients by _time I would like there to be a 2nd result column that accumulates the 1st column by hour.  For example:  the result in row 2 of the 2nd column will be the sum of rows 1 and 2 in the 1st column, the result of row 3 of the 2nd column will be the sum of rows 1 to 3 in the 1st column, etc. Thanks in advance. ... View more

We are looking to provide the last part of a request uri that identifies a file name and has a client identifier variable in the middle of the uri. Sample uri request: GET /someportal/rest/product/v1_0/clientidentifier/filename/fnm_123456789abcd.png HTTP/1.1 The underlined text is the value that I need to extract.  Note the space after the .png. My current attempt is this: index=index source=/source sourcetype=sourcetype | rex field=_raw "GET /someportal/rest/product/v1_0/*/filename/(?<FileName>\d+)" Please let me know how far off I am.  Thanks ... View more

I have a key:value for db names but need only the first part. Example Current DBNAME : db001_inst1:schemanamexyx Or DBNAME : db01_inst1:schemanamexyx Requested REX statement to provide only the values in front of the colon.  I.E., db001_inst1 or db01_inst1 ... View more