https://community.splunk.com/t5/Splunk-Search/Extracting-event-using-rex/m-p/376036#M110470 <P>@HenryFitzerald Rather than pile on to a three-year-old question with an accepted answer, you should ask a new question describing your problem. I did it for you this time. <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Wed, 25 Jul 2018 20:25:28 GMT richgalloway 2018-07-25T20:25:28Z https://community.splunk.com/t5/Splunk-Search/Extracting-event-using-rex/m-p/376035#M110469 <P>Hi ,Could anyone assist I am attempting to perform a query that extracts an event in splunk<BR /> "fd-credit-darc-quotations--gb-hbeu" which is part of a longer string below/</P> <P><CODE>&lt;14&gt;1 2018-07-24T18:34:42.81641+00:00 **whjc100-digital-fet-platform-prd.prod.fd-credit-darc-quotations--gb-hbeu**-1-0-1-20180626161234pred.prd.</CODE></P> <P>I tried using below but it extracts everything starting from fd-credit card but does not stop at --gb-hbeu =&gt; <BR /> <CODE>| rex field=_raw "whjc100-digital-fet-platform-prd.prod.(?.[a-zA-Z0-9]{4}$)"</CODE></P> <P>Could anyone help,Thanks </P> Wed, 25 Jul 2018 14:40:17 GMT https://community.splunk.com/t5/Splunk-Search/Extracting-event-using-rex/m-p/376035#M110469 HenryFitzerald 2018-07-25T14:40:17Z https://community.splunk.com/t5/Splunk-Search/Extracting-event-using-rex/m-p/376036#M110470 <P>@HenryFitzerald Rather than pile on to a three-year-old question with an accepted answer, you should ask a new question describing your problem. I did it for you this time. <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Wed, 25 Jul 2018 20:25:28 GMT https://community.splunk.com/t5/Splunk-Search/Extracting-event-using-rex/m-p/376036#M110470 richgalloway 2018-07-25T20:25:28Z https://community.splunk.com/t5/Splunk-Search/Extracting-event-using-rex/m-p/376037#M110471 <P>Hi</P> <P>Give this a try</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/5447iC0ACB9A4A433DFFC/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Wed, 25 Jul 2018 21:12:19 GMT https://community.splunk.com/t5/Splunk-Search/Extracting-event-using-rex/m-p/376037#M110471 PowerPacked 2018-07-25T21:12:19Z https://community.splunk.com/t5/Splunk-Search/Extracting-event-using-rex/m-p/376038#M110472 <P>Thanks RichGalloway,much appreciated </P> Fri, 27 Jul 2018 09:39:35 GMT https://community.splunk.com/t5/Splunk-Search/Extracting-event-using-rex/m-p/376038#M110472 HenryFitzerald 2018-07-27T09:39:35Z