https://community.splunk.com/t5/Other-Usage/How-to-create-regex-for-AWS-ARN-to-extract-region/m-p/646428#M392 <P><SPAN>Please help to create regx to extract region from below aws ARN(us-west-2)</SPAN></P> <P><SPAN>arn:aws:secretsmanager:us-west-2:1111111111:secret:/rds-oracle/xxxx-xx17sd-xxxxxx-xxx67xxx7gd7133/TEST-01TEST</SPAN></P> Mon, 12 Jun 2023 14:00:58 GMT chvenu17 2023-06-12T14:00:58Z https://community.splunk.com/t5/Other-Usage/How-to-create-regex-for-AWS-ARN-to-extract-region/m-p/646428#M392 <P><SPAN>Please help to create regx to extract region from below aws ARN(us-west-2)</SPAN></P> <P><SPAN>arn:aws:secretsmanager:us-west-2:1111111111:secret:/rds-oracle/xxxx-xx17sd-xxxxxx-xxx67xxx7gd7133/TEST-01TEST</SPAN></P> Mon, 12 Jun 2023 14:00:58 GMT https://community.splunk.com/t5/Other-Usage/How-to-create-regex-for-AWS-ARN-to-extract-region/m-p/646428#M392 chvenu17 2023-06-12T14:00:58Z https://community.splunk.com/t5/Other-Usage/How-to-create-regex-for-AWS-ARN-to-extract-region/m-p/646476#M393 <P>Hi</P><LI-CODE lang="markup">... | rex "^(?:\w+:){3}(?&lt;region&gt;[^:]+)"</LI-CODE><P>this should do the extraction. If the ARN is on field, then you should add “field=&lt;field name&gt;” in rex.</P><P>r. Ismo</P> Fri, 09 Jun 2023 19:48:36 GMT https://community.splunk.com/t5/Other-Usage/How-to-create-regex-for-AWS-ARN-to-extract-region/m-p/646476#M393 isoutamo 2023-06-09T19:48:36Z https://community.splunk.com/t5/Other-Usage/How-to-create-regex-for-AWS-ARN-to-extract-region/m-p/646491#M394 <P>Thank you , its working&nbsp;</P> Sat, 10 Jun 2023 02:36:15 GMT https://community.splunk.com/t5/Other-Usage/How-to-create-regex-for-AWS-ARN-to-extract-region/m-p/646491#M394 chvenu17 2023-06-10T02:36:15Z https://community.splunk.com/t5/Other-Usage/How-to-create-regex-for-AWS-ARN-to-extract-region/m-p/646494#M395 <P>Can you help to brekdown, in case i want to modify to pull different field</P> Sat, 10 Jun 2023 05:41:58 GMT https://community.splunk.com/t5/Other-Usage/How-to-create-regex-for-AWS-ARN-to-extract-region/m-p/646494#M395 chvenu17 2023-06-10T05:41:58Z https://community.splunk.com/t5/Other-Usage/How-to-create-regex-for-AWS-ARN-to-extract-region/m-p/646496#M396 <P>Here is a link&nbsp;<A href="https://regex101.com/r/GVLrA1/1" target="_blank">https://regex101.com/r/GVLrA1/1</A>&nbsp;where you could read what those are meaning. There is also easy to chain it.</P> Sat, 10 Jun 2023 06:48:56 GMT https://community.splunk.com/t5/Other-Usage/How-to-create-regex-for-AWS-ARN-to-extract-region/m-p/646496#M396 isoutamo 2023-06-10T06:48:56Z