https://community.splunk.com/t5/Security/regular-expression/m-p/700432#M18147 regex101.com is your friend <A href="https://regex101.com/r/rB5kWs/1" target="_blank">https://regex101.com/r/rB5kWs/1</A><BR /> Sat, 28 Sep 2024 15:24:06 GMT isoutamo 2024-09-28T15:24:06Z https://community.splunk.com/t5/Security/regular-expression/m-p/699925#M18127 <P>Hi i want to extract highlighted part<BR /><BR />Sep 24 10:43:25 10.82.10.245 [S=217] [BID=d57afa:30] RAISE-ALARM:acProxyConnectionLost: [KOREASBC1] Proxy Set Alarm Proxy Set 1 (PS_ITSP): Proxy lost. looking for another proxy; Severity:major; Source:Board#1/ProxyConnection#1; Unique ID:242; Additional Info1:; [Time:<FONT color="#FFFF00">24-09@17:43:25.248</FONT>] [63380759]</P> Tue, 24 Sep 2024 11:21:21 GMT https://community.splunk.com/t5/Security/regular-expression/m-p/699925#M18127 Siddharthnegi 2024-09-24T11:21:21Z https://community.splunk.com/t5/Security/regular-expression/m-p/699931#M18131 <P>Per <A href="https://regex101.com" target="_self">regex101.com</A>, this expression works with the sample event.</P><LI-CODE lang="markup">Time:(?&lt;time&gt;[^\]]+)</LI-CODE><P>&nbsp;</P> Tue, 24 Sep 2024 12:14:03 GMT https://community.splunk.com/t5/Security/regular-expression/m-p/699931#M18131 richgalloway 2024-09-24T12:14:03Z https://community.splunk.com/t5/Security/regular-expression/m-p/700432#M18147 regex101.com is your friend <A href="https://regex101.com/r/rB5kWs/1" target="_blank">https://regex101.com/r/rB5kWs/1</A><BR /> Sat, 28 Sep 2024 15:24:06 GMT https://community.splunk.com/t5/Security/regular-expression/m-p/700432#M18147 isoutamo 2024-09-28T15:24:06Z