Answer by warren for Regex count capture group members

In Splunk, to capture multiple matches from a single event, you need to add max_match=0 to your rex, per docs.Splunk

But to get them then separated into a singlevalue field from the [potential] multivalue field job_ids that you made, you need to mvxepand or similar

So this should get you closer:

| rex field=message max_match=0 "\"(?<job_id>(?:\w+-\w+-\w+-\w+-\w+)+),?\"" 
| mvexpand job_id
| stats dc(job_id)

I also changed from count to dc, as it seems you’re looking for a unique count of job IDs, and not just a count of how many in total you’ve seen

from User warren – Stack Overflow https://stackoverflow.com/questions/75188876/regex-count-capture-group-members/75210114#75210114
via IFTTT