https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-string-from-an-event/m-p/435097#M124085 <P>thank you so much mayurr98 and richgalloway. i will try the code. </P> Wed, 07 Aug 2019 20:25:58 GMT owie6466 2019-08-07T20:25:58Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-string-from-an-event/m-p/435094#M124082 <P>Hello, I am very new to Splunk and I would like some help in doing this.<BR /><BR /> I need to extract from this field:<BR /> Event<BR /> <STRONG>1 hour ago,</STRONG> vmpit-p4cti002.lm.lmig.com, windows 6.3.9600.</P> <P>and then check if it is less &gt; 4 hours</P> <P>I've been going through some answers and I, unfortunately, can't find the right one. </P> <P>Thank you so much for any assistance. </P> Wed, 07 Aug 2019 19:30:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-string-from-an-event/m-p/435094#M124082 owie6466 2019-08-07T19:30:38Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-string-from-an-event/m-p/435095#M124083 <P>Try:</P> <PRE><CODE>| rex "(?&lt;Time&gt;\d{1,2})\s+hour\s+ago" | where Time &lt; 4 </CODE></PRE> Wed, 07 Aug 2019 19:51:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-string-from-an-event/m-p/435095#M124083 mayurr98 2019-08-07T19:51:51Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-string-from-an-event/m-p/435096#M124084 <P>I offer a slight modification to allow for "2 hours ago".</P> <P><CODE>| rex "(?&lt;Time&gt;\d{1,2})\s+hours?\s+ago" | where Time &lt; 4</CODE></P> Wed, 07 Aug 2019 19:55:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-string-from-an-event/m-p/435096#M124084 richgalloway 2019-08-07T19:55:12Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-string-from-an-event/m-p/435097#M124085 <P>thank you so much mayurr98 and richgalloway. i will try the code. </P> Wed, 07 Aug 2019 20:25:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-string-from-an-event/m-p/435097#M124085 owie6466 2019-08-07T20:25:58Z