https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-obtain-a-single-string-from-a-string/m-p/428034#M122498 <P>If it's not clear from the above, the piece you need, @Nidd, is to add after whatever search you have to return your rows...</P> <PRE><CODE>| rex field=data "for\s(?&lt;suspect&gt;\d+)\sand\s(?&lt;altSuspect&gt;\d+)" | table suspect altSuspect </CODE></PRE> <P>Those two lines should extract your two fields then create a table out of them for you.</P> <P>Happy Splunking!<BR /> -Rich</P> Mon, 04 Jun 2018 17:10:29 GMT Richfez 2018-06-04T17:10:29Z https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-obtain-a-single-string-from-a-string/m-p/428032#M122496 <P>I have not used regex in my queries much. Any help in resolving this would be much helpful. </P> <P>I have the following log:</P> <PRE><CODE>INFO | 2018-06-04 09:26:46,449 | EvergreenWorker - starting createSuspects for 262352812954213803 and 266946419581359002 INFO | 2018-06-04 09:26:46,449 | EvergreenWorker - starting createSuspects for 262352812954213903 and 266946419581359003 </CODE></PRE> <P>I wish to obtain the following result:</P> <PRE><CODE>---------------------------------------------- suspect | altSuspect ---------------------------------------------- 262352812954213803 | 266946419581359002 262352812954213903 | 266946419581359003 ---------------------------------------------- </CODE></PRE> <P>i.e. The IDs obtained on the logs as suspect and altSuspect.</P> Mon, 04 Jun 2018 16:38:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-obtain-a-single-string-from-a-string/m-p/428032#M122496 Nidd 2018-06-04T16:38:06Z https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-obtain-a-single-string-from-a-string/m-p/428033#M122497 <P>try this:</P> <PRE><CODE>| makeresults count =1 | eval data = " INFO | 2018-06-04 09:26:46,449 | EvergreenWorker - starting createSuspects for 262352812954213803 and 266946419581359002 ;INFO | 2018-06-04 09:26:46,449 | EvergreenWorker - starting createSuspects for 262352812954213903 and 266946419581359003" | makemv delim=";" data | mvexpand data | rex field=data "for\s(?&lt;suspect&gt;\d+)\sand\s(?&lt;altSuspect&gt;\d+)" | table suspect altSuspect </CODE></PRE> <P>screenshot:<BR /> <span class="lia-inline-image-display-wrapper" image-alt="![alt text][1]"><img src="https://community.splunk.com/t5/image/serverpage/image-id/5084iC7FC1A5474837877/image-size/large?v=v2&amp;px=999" role="button" title="![alt text][1]" alt="![alt text][1]" /></span></P> <P>hope it helps</P> Mon, 04 Jun 2018 17:07:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-obtain-a-single-string-from-a-string/m-p/428033#M122497 adonio 2018-06-04T17:07:50Z https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-obtain-a-single-string-from-a-string/m-p/428034#M122498 <P>If it's not clear from the above, the piece you need, @Nidd, is to add after whatever search you have to return your rows...</P> <PRE><CODE>| rex field=data "for\s(?&lt;suspect&gt;\d+)\sand\s(?&lt;altSuspect&gt;\d+)" | table suspect altSuspect </CODE></PRE> <P>Those two lines should extract your two fields then create a table out of them for you.</P> <P>Happy Splunking!<BR /> -Rich</P> Mon, 04 Jun 2018 17:10:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-obtain-a-single-string-from-a-string/m-p/428034#M122498 Richfez 2018-06-04T17:10:29Z https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-obtain-a-single-string-from-a-string/m-p/428035#M122499 <P>Thanks Adonio ! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 05 Jun 2018 05:41:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-obtain-a-single-string-from-a-string/m-p/428035#M122499 Nidd 2018-06-05T05:41:58Z https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-obtain-a-single-string-from-a-string/m-p/428036#M122500 <P>Thank you Rich <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 05 Jun 2018 05:42:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-obtain-a-single-string-from-a-string/m-p/428036#M122500 Nidd 2018-06-05T05:42:11Z