Splunk: Assigning variables

Question

I have some data in splunk im trying to create a dashboard for. I am unsure how to assign a variable name for the 2 pieces of data im looking to extract. My data looks like

From 5 new registrations, 4 emails were confirmed

I am able to search this data very easily with the following query

search "From * new registrations, * emails were confirmed"

How do i assign a variable to each of the asterisks?

Thank you!

Answer 1

There likely are a few ways to do that. I like using regular expressions and the rex command.

index=foo "From * new registrations, * emails were confirmed"
| rex "From (?<fromCount>\d+) new registrations, (?<emailCount>\d+) emails were confirmed"