https://community.splunk.com/t5/Getting-Data-In/How-can-I-split-the-field/m-p/383868#M69089 <P>Something like - <CODE>(?&lt;first&gt;.*)-(?&lt;second&gt;.*)</CODE></P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/5474i2D35B1EA95DA2841/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Fri, 03 Aug 2018 21:49:34 GMT ddrillic 2018-08-03T21:49:34Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-split-the-field/m-p/383867#M69088 <P>How can I split the field<BR /> And I have used the method<BR /> field=资源昵称 "(?\w+)-(?\w+)-(?\S+)"<BR /> But it can not fetch second string. <BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/5475iCC57E162D6A69024/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Fri, 03 Aug 2018 05:54:51 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-split-the-field/m-p/383867#M69088 flzhang132 2018-08-03T05:54:51Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-split-the-field/m-p/383868#M69089 <P>Something like - <CODE>(?&lt;first&gt;.*)-(?&lt;second&gt;.*)</CODE></P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/5474i2D35B1EA95DA2841/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Fri, 03 Aug 2018 21:49:34 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-split-the-field/m-p/383868#M69089 ddrillic 2018-08-03T21:49:34Z