https://community.splunk.com/t5/Other-Usage/REGEX/m-p/683308#M1718 <LI-CODE lang="markup">| regex permission="Permission12345"</LI-CODE> Thu, 04 Apr 2024 17:46:03 GMT ITWhisperer 2024-04-04T17:46:03Z https://community.splunk.com/t5/Other-Usage/REGEX/m-p/683300#M1717 <P>Hello&nbsp;</P><P>Can i get a regex that matches with this;&nbsp; permission=Permission12345. I have tried to bring up one but its not working. Thanks in advance&nbsp;</P> Thu, 04 Apr 2024 16:53:53 GMT https://community.splunk.com/t5/Other-Usage/REGEX/m-p/683300#M1717 whitecat001 2024-04-04T16:53:53Z https://community.splunk.com/t5/Other-Usage/REGEX/m-p/683308#M1718 <LI-CODE lang="markup">| regex permission="Permission12345"</LI-CODE> Thu, 04 Apr 2024 17:46:03 GMT https://community.splunk.com/t5/Other-Usage/REGEX/m-p/683308#M1718 ITWhisperer 2024-04-04T17:46:03Z https://community.splunk.com/t5/Other-Usage/REGEX/m-p/683366#M1719 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/264928">@whitecat001</a>&nbsp;,</P><P>you can use the regex hinted&nbsp; by&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;, but when you ha a pais fieldnem=fieldvalue, as in your case, you could simply use the field for searching your data:</P><LI-CODE lang="markup">index=your_index permission=Permission12345 | ...</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Fri, 05 Apr 2024 05:36:18 GMT https://community.splunk.com/t5/Other-Usage/REGEX/m-p/683366#M1719 gcusello 2024-04-05T05:36:18Z