https://community.splunk.com/t5/Splunk-Search/How-do-I-get-specific-words-within-a-text/m-p/385898#M112664 <P>Hi @shtom</P> <P>Try</P> <PRE><CODE>your query....|rex field=ActiveLoadId "(?P&lt;ActiveLoadId&gt;.*)-" </CODE></PRE> Tue, 12 Feb 2019 15:53:16 GMT vnravikumar 2019-02-12T15:53:16Z https://community.splunk.com/t5/Splunk-Search/How-do-I-get-specific-words-within-a-text/m-p/385897#M112663 <P>The below table is what I get from a search on Splunk"</P> <P><STRONG>ActiveLoadId</STRONG><BR /> Jabber_for_iOS-12.1.2.270036<BR /> Jabber_for_iOS-12.0.1.263155<BR /> Jabber_for_Android-12.5.1.276987<BR /> Jabber_for_Windows-11.9.3.60004<BR /> Jabber_for_Windows-12.5.0.22884</P> <P>But what i want is to modify the output text under Field "ActiveLoadID" to see the first few characters. Example below:</P> <P><STRONG>ActiveLoadId</STRONG><BR /> Jabber_for_iOS<BR /> Jabber_for_iOS<BR /> Jabber_for_Android<BR /> Jabber_for_Windows<BR /> Jabber_for_Windows</P> <P>My current query is:</P> <PRE><CODE> "ActiveLoadId=Jabber_for" | rare limit=20000 ActiveLoadId </CODE></PRE> <P>Appreciate your help!</P> Tue, 29 Sep 2020 23:15:47 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-specific-words-within-a-text/m-p/385897#M112663 shtom 2020-09-29T23:15:47Z https://community.splunk.com/t5/Splunk-Search/How-do-I-get-specific-words-within-a-text/m-p/385898#M112664 <P>Hi @shtom</P> <P>Try</P> <PRE><CODE>your query....|rex field=ActiveLoadId "(?P&lt;ActiveLoadId&gt;.*)-" </CODE></PRE> Tue, 12 Feb 2019 15:53:16 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-specific-words-within-a-text/m-p/385898#M112664 vnravikumar 2019-02-12T15:53:16Z https://community.splunk.com/t5/Splunk-Search/How-do-I-get-specific-words-within-a-text/m-p/385899#M112665 <P>beautiful.....it worked</P> Tue, 12 Feb 2019 20:05:11 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-specific-words-within-a-text/m-p/385899#M112665 shtom 2019-02-12T20:05:11Z