https://community.splunk.com/t5/Getting-Data-In/field-extract-extract-everything-between-two-values/m-p/329647#M94934 <P>In the field extractor, you've option to specify your own regex. You can use <CODE>cat=(?&lt;FieldNameOfYourChoosing&gt;.+) sourceServiceName=</CODE> to extract what you need.</P> Thu, 12 Apr 2018 21:55:01 GMT somesoni2 2018-04-12T21:55:01Z https://community.splunk.com/t5/Getting-Data-In/field-extract-extract-everything-between-two-values/m-p/329646#M94933 <P>I want to simply take an event and parse EVERYTHING between two strings and make it a field...the built in field extractor in splunk is garbage and does not help with this simple extraction. The string would be like below:</P> <P>suser=Joe blow cat=Upload Policy - On Corp sourceServiceName=Server01</P> <P>How can I simply (within the field extractor, not a search), take everything between "cat=" and "SourceServiceName=" and make that into a field called policyName?</P> Thu, 12 Apr 2018 20:55:45 GMT https://community.splunk.com/t5/Getting-Data-In/field-extract-extract-everything-between-two-values/m-p/329646#M94933 splunkbacon 2018-04-12T20:55:45Z https://community.splunk.com/t5/Getting-Data-In/field-extract-extract-everything-between-two-values/m-p/329647#M94934 <P>In the field extractor, you've option to specify your own regex. You can use <CODE>cat=(?&lt;FieldNameOfYourChoosing&gt;.+) sourceServiceName=</CODE> to extract what you need.</P> Thu, 12 Apr 2018 21:55:01 GMT https://community.splunk.com/t5/Getting-Data-In/field-extract-extract-everything-between-two-values/m-p/329647#M94934 somesoni2 2018-04-12T21:55:01Z