https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-extracting-few-characters-of-a-field/m-p/396704#M115193 <P>Hi</P> <P>Try this,</P> <PRE><CODE>| makeresults | eval VLAN ="Vlan819(RVP_CDN)" | eval result = mvindex(split(VLAN,"("),0) </CODE></PRE> Mon, 15 Jul 2019 16:32:41 GMT vnravikumar 2019-07-15T16:32:41Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-extracting-few-characters-of-a-field/m-p/396701#M115190 <P>My VLAN value looks like below:</P> <PRE><CODE>|inputlookup vrf_usage.csv | search VRF="*" | search VLAN=Vlan819(RVP_CDN) </CODE></PRE> <P>Could you please help me getting VLAN value as Vlan819 just before ( symbol. That is just before the bracket starts.</P> Mon, 15 Jul 2019 10:25:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-extracting-few-characters-of-a-field/m-p/396701#M115190 surekhasplunk 2019-07-15T10:25:59Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-extracting-few-characters-of-a-field/m-p/396702#M115191 <P>@surekhasplunk ,</P> <P>Try</P> <PRE><CODE>|rex field=VLAN "(?&lt;VLAN&gt;.+)\(" </CODE></PRE> Mon, 15 Jul 2019 10:55:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-extracting-few-characters-of-a-field/m-p/396702#M115191 renjith_nair 2019-07-15T10:55:45Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-extracting-few-characters-of-a-field/m-p/396703#M115192 <P>Hi surekhasplunk,<BR /> it could be useful to share a sample of your logs.<BR /> Anyway, you could use something like this</P> <PRE><CODE>| rex "Vlan819&lt;VLAN&gt;\w+)" </CODE></PRE> <P>to test with a sample.</P> <P>Bye.<BR /> Giuseppe</P> Mon, 15 Jul 2019 10:57:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-extracting-few-characters-of-a-field/m-p/396703#M115192 gcusello 2019-07-15T10:57:06Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-extracting-few-characters-of-a-field/m-p/396704#M115193 <P>Hi</P> <P>Try this,</P> <PRE><CODE>| makeresults | eval VLAN ="Vlan819(RVP_CDN)" | eval result = mvindex(split(VLAN,"("),0) </CODE></PRE> Mon, 15 Jul 2019 16:32:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-extracting-few-characters-of-a-field/m-p/396704#M115193 vnravikumar 2019-07-15T16:32:41Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-extracting-few-characters-of-a-field/m-p/396705#M115194 <P>Looks great - </P> <PRE><CODE>| makeresults | eval VLAN="Vlan819(RVP_CDN)" | rex field=VLAN "(?&lt;VLAN&gt;.+)\(" </CODE></PRE> Mon, 15 Jul 2019 18:33:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-extracting-few-characters-of-a-field/m-p/396705#M115194 ddrillic 2019-07-15T18:33:03Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-extracting-few-characters-of-a-field/m-p/396706#M115195 <P>There are many ways. Here is another one:</P> <PRE><CODE>... | rex field=VLAN mode=sed "s/\(.*$//" </CODE></PRE> <P>For example:</P> <PRE><CODE>| makeresults | eval VLAN="vlan(foo)" | rex field=VLAN mode=sed "s/\(.*$//" </CODE></PRE> Mon, 15 Jul 2019 20:00:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-extracting-few-characters-of-a-field/m-p/396706#M115195 woodcock 2019-07-15T20:00:02Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-extracting-few-characters-of-a-field/m-p/396707#M115196 <P>Come back and click <CODE>Accept</CODE> on the best answer, @surekhasplunk!</P> Tue, 23 Jul 2019 17:09:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-extracting-few-characters-of-a-field/m-p/396707#M115196 woodcock 2019-07-23T17:09:54Z