https://community.splunk.com/t5/Splunk-Search/How-to-extract-string-from-a-position-until-the-end-of-line/m-p/342965#M101567 <P>Thanks. It works.</P> Thu, 09 Mar 2017 11:06:26 GMT mdzmuran 2017-03-09T11:06:26Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-string-from-a-position-until-the-end-of-line/m-p/342963#M101565 <P>I have lines like this:</P> <PRE><CODE>[2011/02/11@10:33:13.978+0100] P-18679 T-0 I Usr 2: (49) SYSTEM ERROR: Memory violation. </CODE></PRE> <P>How can I extract the string beginning with "Memory viol" till the end of line? The string is one line only, but may be much longer with any characters.</P> Wed, 08 Mar 2017 16:17:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-string-from-a-position-until-the-end-of-line/m-p/342963#M101565 mdzmuran 2017-03-08T16:17:50Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-string-from-a-position-until-the-end-of-line/m-p/342964#M101566 <P>Your regex will look like this </P> <PRE><CODE>| rex field=_raw "(?&lt;myfield&gt;Memory viol.*)$" </CODE></PRE> <P>or you might prefer</P> <PRE><CODE>| rex field=_raw "SYSTEM ERROR:\s+(?&lt;myfield&gt;.*)$" </CODE></PRE> <P>Both of these assume that there will never be any fields after the system error. The $ at the end is a regex anchor for "the end of the field we are searching"</P> Wed, 08 Mar 2017 20:47:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-string-from-a-position-until-the-end-of-line/m-p/342964#M101566 DalJeanis 2017-03-08T20:47:02Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-string-from-a-position-until-the-end-of-line/m-p/342965#M101567 <P>Thanks. It works.</P> Thu, 09 Mar 2017 11:06:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-string-from-a-position-until-the-end-of-line/m-p/342965#M101567 mdzmuran 2017-03-09T11:06:26Z