https://community.splunk.com/t5/Monitoring-Splunk/How-to-extract-all-the-fields-after-a-certain-string-in-splunk/m-p/554881#M5053 <P>Hi <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/227232">@aaa2324</a>,</P><P>Good for you, see next time!</P><P>Ciao and happy splunking.</P><P>Giuseppe</P><P>P.S.: Karma Points are appreciated <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Tue, 08 Jun 2021 10:18:40 GMT gcusello 2021-06-08T10:18:40Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-extract-all-the-fields-after-a-certain-string-in-splunk/m-p/554876#M5050 <P>In below eg I have some random text after the word type and I want to extract all the strings/ numbers that comes after type, can it be done using Rex ? Please suggest the command&nbsp;</P><P>type abc xyz aabbbbc xxxxyyyy bbbbb uuuuuu 12345677</P> Tue, 08 Jun 2021 10:03:30 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-extract-all-the-fields-after-a-certain-string-in-splunk/m-p/554876#M5050 aaa2324 2021-06-08T10:03:30Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-extract-all-the-fields-after-a-certain-string-in-splunk/m-p/554878#M5051 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/227232">@aaa2324</a>,</P><P>if you want to extract all the text after "type", you have to use a regex like the following:</P><LI-CODE lang="markup">| rex "type\s+(?&lt;your_field&gt;.*)"</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Tue, 08 Jun 2021 10:07:43 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-extract-all-the-fields-after-a-certain-string-in-splunk/m-p/554878#M5051 gcusello 2021-06-08T10:07:43Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-extract-all-the-fields-after-a-certain-string-in-splunk/m-p/554880#M5052 <P>Thanks a lot it works <span class="lia-unicode-emoji" title=":thumbs_up:">👍</span></P> Tue, 08 Jun 2021 10:14:43 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-extract-all-the-fields-after-a-certain-string-in-splunk/m-p/554880#M5052 aaa2324 2021-06-08T10:14:43Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-extract-all-the-fields-after-a-certain-string-in-splunk/m-p/554881#M5053 <P>Hi <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/227232">@aaa2324</a>,</P><P>Good for you, see next time!</P><P>Ciao and happy splunking.</P><P>Giuseppe</P><P>P.S.: Karma Points are appreciated <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Tue, 08 Jun 2021 10:18:40 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-extract-all-the-fields-after-a-certain-string-in-splunk/m-p/554881#M5053 gcusello 2021-06-08T10:18:40Z