https://community.splunk.com/t5/Splunk-Dev/need-rex-to-fetch-string-between/m-p/534610#M9613 <P>This may help..</P><P>|makeresults | eval _raw="[INFO ] [app_mot_auto_toyota_cars_SOA]" | rex field=_raw "\[INFO\s]\s\[(?&lt;Applname&gt;\S+)]"</P> Sat, 02 Jan 2021 12:40:25 GMT saravanan90 2021-01-02T12:40:25Z https://community.splunk.com/t5/Splunk-Dev/need-rex-to-fetch-string-between/m-p/534609#M9612 <P>I need to fetch the value 'app_mot_auto_toyota_cars_SOA' from the below string.&nbsp; I tried with the rex -&nbsp;rex field=_raw "[INFO ]\s[(?P&lt;Applname&gt;)]\s+".&nbsp; &nbsp;But it is not working.&nbsp;<BR /><BR />Can anyone please help me with the regex expression.</P><P>&gt;&nbsp;[INFO ] [app_mot_auto_toyota_cars_SOA]</P> Sat, 02 Jan 2021 11:08:18 GMT https://community.splunk.com/t5/Splunk-Dev/need-rex-to-fetch-string-between/m-p/534609#M9612 rkishoreqa 2021-01-02T11:08:18Z https://community.splunk.com/t5/Splunk-Dev/need-rex-to-fetch-string-between/m-p/534610#M9613 <P>This may help..</P><P>|makeresults | eval _raw="[INFO ] [app_mot_auto_toyota_cars_SOA]" | rex field=_raw "\[INFO\s]\s\[(?&lt;Applname&gt;\S+)]"</P> Sat, 02 Jan 2021 12:40:25 GMT https://community.splunk.com/t5/Splunk-Dev/need-rex-to-fetch-string-between/m-p/534610#M9613 saravanan90 2021-01-02T12:40:25Z