https://community.splunk.com/t5/Splunk-Search/How-to-extract-string-from-a-paragraph/m-p/377616#M110742 <P>Is it giving any error? Are able to see <CODE>ROUTEORDER</CODE> field under interesting fields section? Also, can you paste a screenshot of data along with your search.</P> Fri, 27 Jul 2018 14:34:57 GMT sudosplunk 2018-07-27T14:34:57Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-string-from-a-paragraph/m-p/377613#M110739 <P>Hi,<BR /> Below is my paragraph and I want to extract the routeorder value from the paragraph.</P> <P>Please assist.</P> <PRE><CODE>other_app_launch_data: Third Party App Launch Data:354736071554019 Data passed:Bundle{service_url : <A href="http://example.com/service" target="test_blank">http://example.com/service</A>; site_number : S04136; vehicle_id : 210648; driver_id : 082775; pre_post : post; tabletid : 354736071554019; first_name : Gennadiy; environment : Production; fuel : ; route_id : ***ROUTEORDER#**158682677**;*** device_id : 354736071554019; DVIR_RESPONSE_ACTION : DVIR_POST_CHECK_RESPONSE; meter_time : 717; meter_distance : 161724; last_name : Trofimchik; }Bundle reqCode:9804 </CODE></PRE> Fri, 27 Jul 2018 13:41:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-string-from-a-paragraph/m-p/377613#M110739 ppanchal 2018-07-27T13:41:50Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-string-from-a-paragraph/m-p/377614#M110740 <P>Hi there,</P> <P>Try this,</P> <PRE><CODE>your_search | rex field=_raw "route_id\s\:\s\w+\#(?&lt;ROUTEORDER&gt;\d+)" </CODE></PRE> Fri, 27 Jul 2018 13:54:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-string-from-a-paragraph/m-p/377614#M110740 sudosplunk 2018-07-27T13:54:41Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-string-from-a-paragraph/m-p/377615#M110741 <P>No this did not work. I am not getting anything with the search.</P> Fri, 27 Jul 2018 14:29:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-string-from-a-paragraph/m-p/377615#M110741 ppanchal 2018-07-27T14:29:29Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-string-from-a-paragraph/m-p/377616#M110742 <P>Is it giving any error? Are able to see <CODE>ROUTEORDER</CODE> field under interesting fields section? Also, can you paste a screenshot of data along with your search.</P> Fri, 27 Jul 2018 14:34:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-string-from-a-paragraph/m-p/377616#M110742 sudosplunk 2018-07-27T14:34:57Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-string-from-a-paragraph/m-p/377617#M110743 <P>yes, i got it thanks.</P> Fri, 27 Jul 2018 14:46:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-string-from-a-paragraph/m-p/377617#M110743 ppanchal 2018-07-27T14:46:58Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-string-from-a-paragraph/m-p/377618#M110744 <P>Great. Please accept the answer if it helped you.</P> Fri, 27 Jul 2018 14:50:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-string-from-a-paragraph/m-p/377618#M110744 sudosplunk 2018-07-27T14:50:23Z