https://community.splunk.com/t5/Splunk-Search/regex-help/m-p/351632#M104083 <P>Hi kiran331,<BR /> Try this:</P> <PRE><CODE>your_search | rex field=source "ciscoasa\/(?&lt;host&gt;[^\/]*)" | ... </CODE></PRE> <P>you can test it at <A href="https://regex101.com/r/wrL9Ze/1">https://regex101.com/r/wrL9Ze/1</A></P> <P>Bye.<BR /> giuseppe</P> Tue, 13 Jun 2017 06:26:14 GMT gcusello 2017-06-13T06:26:14Z https://community.splunk.com/t5/Splunk-Search/regex-help/m-p/351630#M104081 <P>How to extract the IP OR hostname from the field "source"?</P> <P>source=/opt/var/log/splunk/ciscoasa/11.12.22.345/2017_06_05_21_cisco.log<BR /> source=/opt/var/log/splunk/ciscoasa/abc_xyz/2017_06_05_21_cisco.log</P> <P>I need to extract 11.12.22.345 &amp; abc_xyz</P> Tue, 29 Sep 2020 14:29:21 GMT https://community.splunk.com/t5/Splunk-Search/regex-help/m-p/351630#M104081 kiran331 2020-09-29T14:29:21Z https://community.splunk.com/t5/Splunk-Search/regex-help/m-p/351631#M104082 <P>Hi Kiran, Verified and this works fine - </P> <P><CODE>source="ciscoasa.txt" | rex field=_raw "ciscoasa\/(?&lt;ipAddress&gt;.*)\/" | table ipAddress _raw</CODE></P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/3079i93DEAB87199C765F/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Tue, 13 Jun 2017 02:58:20 GMT https://community.splunk.com/t5/Splunk-Search/regex-help/m-p/351631#M104082 inventsekar 2017-06-13T02:58:20Z https://community.splunk.com/t5/Splunk-Search/regex-help/m-p/351632#M104083 <P>Hi kiran331,<BR /> Try this:</P> <PRE><CODE>your_search | rex field=source "ciscoasa\/(?&lt;host&gt;[^\/]*)" | ... </CODE></PRE> <P>you can test it at <A href="https://regex101.com/r/wrL9Ze/1">https://regex101.com/r/wrL9Ze/1</A></P> <P>Bye.<BR /> giuseppe</P> Tue, 13 Jun 2017 06:26:14 GMT https://community.splunk.com/t5/Splunk-Search/regex-help/m-p/351632#M104083 gcusello 2017-06-13T06:26:14Z https://community.splunk.com/t5/Splunk-Search/regex-help/m-p/351633#M104084 <P>Hi, </P> <P>because I was bored I made this redundant answer.</P> <PRE><CODE>yoursearch | rex field=source "(?&lt;host&gt;[^\/]+)\/[^\/]+(?:$)" </CODE></PRE> Tue, 13 Jun 2017 12:46:49 GMT https://community.splunk.com/t5/Splunk-Search/regex-help/m-p/351633#M104084 horsefez 2017-06-13T12:46:49Z