https://community.splunk.com/t5/Splunk-Enterprise-Security/Extracting-SHA256-field/m-p/482004#M7777 <P>Thank you for the help!</P> Thu, 19 Sep 2019 05:51:01 GMT emkaxon 2019-09-19T05:51:01Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Extracting-SHA256-field/m-p/482002#M7775 <P>Hello,</P> <P>I am trying to extract fields using Splunk field extractor and I reached a point where I got the following error <STRONG>" The extraction failed. If you are extracting multiple fields, try removing one or more fields. Start with extractions that are embedded within longer text strings."</STRONG></P> <P>The most common solution found on this forum is to write my own regular expression manually.</P> <P>This is a sample log from which I need to extract the field "process_sha256":</P> <P><STRONG>process_sha256":"fa03997f62beaf057023e5627881ecd4829e3c8383fd44b33f5e30a47ba25e31","processblock_count":0,"regmod_count":3,"segment_id":"1568367814899","start":"2019-09-13T09:41:19.404Z"</STRONG></P> <P>Does anyone have an idea what could be the proper regular expression to insert in the field extractor?</P> <P>Thank you</P> Wed, 30 Sep 2020 02:11:59 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Extracting-SHA256-field/m-p/482002#M7775 emkaxon 2020-09-30T02:11:59Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Extracting-SHA256-field/m-p/482003#M7776 <P>Try <CODE>process_sha256":"(?&lt;sha256&gt;[^"]+)</CODE>.</P> Tue, 17 Sep 2019 18:13:15 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Extracting-SHA256-field/m-p/482003#M7776 richgalloway 2019-09-17T18:13:15Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Extracting-SHA256-field/m-p/482004#M7777 <P>Thank you for the help!</P> Thu, 19 Sep 2019 05:51:01 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Extracting-SHA256-field/m-p/482004#M7777 emkaxon 2019-09-19T05:51:01Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Extracting-SHA256-field/m-p/482005#M7778 <P>@emkaxon If your problem is resolved, please accept the answer to help future readers.</P> Thu, 19 Sep 2019 12:45:25 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Extracting-SHA256-field/m-p/482005#M7778 richgalloway 2019-09-19T12:45:25Z