https://community.splunk.com/t5/Splunk-Search/How-do-you-extract-a-new-field-from-a-source-field/m-p/391028#M113829 <P>Great! Thanks for accepting <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 19 Feb 2019 11:19:05 GMT chrisyounger 2019-02-19T11:19:05Z https://community.splunk.com/t5/Splunk-Search/How-do-you-extract-a-new-field-from-a-source-field/m-p/391025#M113826 <P>I have a log with below as a source field from which I need to extract the field Gateway name (<STRONG>My_Gateway_NONPROD</STRONG>). </P> <P>Any help in how to extract it?.</P> <PRE><CODE>source= /apps/geneos/gateway/logs/My_Gateway_NONPROD.log </CODE></PRE> Tue, 29 Sep 2020 23:17:56 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-extract-a-new-field-from-a-source-field/m-p/391025#M113826 pbsuju 2020-09-29T23:17:56Z https://community.splunk.com/t5/Splunk-Search/How-do-you-extract-a-new-field-from-a-source-field/m-p/391026#M113827 <P>hi @pbsuju </P> <P>Give this a try : <CODE>| rex field=source ".*\/(?&lt;gateway_name&gt;[^\.]*)" | table gateway_name</CODE></P> <P>All the best!</P> Tue, 19 Feb 2019 11:12:00 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-extract-a-new-field-from-a-source-field/m-p/391026#M113827 chrisyounger 2019-02-19T11:12:00Z https://community.splunk.com/t5/Splunk-Search/How-do-you-extract-a-new-field-from-a-source-field/m-p/391027#M113828 <P>Great thanks. It worked</P> Tue, 19 Feb 2019 11:17:23 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-extract-a-new-field-from-a-source-field/m-p/391027#M113828 pbsuju 2019-02-19T11:17:23Z https://community.splunk.com/t5/Splunk-Search/How-do-you-extract-a-new-field-from-a-source-field/m-p/391028#M113829 <P>Great! Thanks for accepting <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 19 Feb 2019 11:19:05 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-extract-a-new-field-from-a-source-field/m-p/391028#M113829 chrisyounger 2019-02-19T11:19:05Z