topic Re: How do I get my rex search to extract a string between two strings from a sample below and concat it with the fixed string &quot;751.&quot; in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-do-I-get-my-rex-search-to-extract-a-string-between-two/m-p/373828#M109922 <P>Another way is this (assuming your current input string is available as field <CODE>input</CODE></P> <PRE><CODE>your current search | eval output=replace(input,"^(.*)(\d+)-(\d+)(\s*:.+)$","751.\3") </CODE></PRE> Wed, 04 Oct 2017 13:43:04 GMT somesoni2 2017-10-04T13:43:04Z How do I get my rex search to extract a string between two strings from a sample below and concat it with the fixed string "751." https://community.splunk.com/t5/Splunk-Search/How-do-I-get-my-rex-search-to-extract-a-string-between-two/m-p/373826#M109920 <P>Example1 </P> <P>Input: 352322648-1112 : D_SSPP-HNW_SD-AVI<BR /> Output i want : "751.1112"</P> <P>Example2 </P> <P>Input: 335587620-43300 : DEMO<BR /> Output i want: "751.43300"</P> <P>Thanks</P> Tue, 29 Sep 2020 16:05:34 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-my-rex-search-to-extract-a-string-between-two/m-p/373826#M109920 Veeruswathi 2020-09-29T16:05:34Z Re: How do I get my rex search to extract a string between two strings from a sample below and concat it with the fixed string "751." https://community.splunk.com/t5/Splunk-Search/How-do-I-get-my-rex-search-to-extract-a-string-between-two/m-p/373827#M109921 <P>Here's one way.</P> <PRE><CODE>... | rex "Input: \d+-(?&lt;field&gt;\d+)" | eval newField="751.".field | ... </CODE></PRE> Wed, 04 Oct 2017 12:26:30 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-my-rex-search-to-extract-a-string-between-two/m-p/373827#M109921 richgalloway 2017-10-04T12:26:30Z Re: How do I get my rex search to extract a string between two strings from a sample below and concat it with the fixed string "751." https://community.splunk.com/t5/Splunk-Search/How-do-I-get-my-rex-search-to-extract-a-string-between-two/m-p/373828#M109922 <P>Another way is this (assuming your current input string is available as field <CODE>input</CODE></P> <PRE><CODE>your current search | eval output=replace(input,"^(.*)(\d+)-(\d+)(\s*:.+)$","751.\3") </CODE></PRE> Wed, 04 Oct 2017 13:43:04 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-my-rex-search-to-extract-a-string-between-two/m-p/373828#M109922 somesoni2 2017-10-04T13:43:04Z