topic Re: Need to write both rex and regex in Splunk Search https://community.splunk.com/t5/Splunk-Search/Need-to-write-both-rex-and-regex/m-p/452804#M128194 <P>This worked. Thanks a lot</P> Mon, 01 Jul 2019 07:02:09 GMT vishwanadhan_mu 2019-07-01T07:02:09Z Need to write both rex and regex https://community.splunk.com/t5/Splunk-Search/Need-to-write-both-rex-and-regex/m-p/452801#M128191 <P>"C:\Users\TestUser\AppData\Local\Microsoft\Teams\Update.exe" --processStart "Teams.exe" --process-start-args "--system-initiated"</P> <P>Could someone help me writing regex and rex to extract field(which is a process) name after --processStart .</P> <P>Next I'll filter out filed name which I don't want match.</P> <P>Thanks in Advance</P> Mon, 01 Jul 2019 06:33:42 GMT https://community.splunk.com/t5/Splunk-Search/Need-to-write-both-rex-and-regex/m-p/452801#M128191 vishwanadhan_mu 2019-07-01T06:33:42Z Re: Need to write both rex and regex https://community.splunk.com/t5/Splunk-Search/Need-to-write-both-rex-and-regex/m-p/452802#M128192 <P>Hi</P> <P>Try this</P> <PRE><CODE>| makeresults | eval temp="\"C:\Users\TestUser\AppData\Local\Microsoft\Teams\Update.exe\" --processStart \"Teams.exe\" --process-start-args \"--system-initiated\"" | rex field=temp "--processStart\s\"(?P&lt;processname&gt;[^--]+)\"" </CODE></PRE> Mon, 01 Jul 2019 06:43:56 GMT https://community.splunk.com/t5/Splunk-Search/Need-to-write-both-rex-and-regex/m-p/452802#M128192 vnravikumar 2019-07-01T06:43:56Z Re: Need to write both rex and regex https://community.splunk.com/t5/Splunk-Search/Need-to-write-both-rex-and-regex/m-p/452803#M128193 <P>Try this.</P> <P>Field extracted using space as delimiter.</P> <PRE><CODE>| makeresults | eval input="\"C:\Users\TestUser\AppData\Local\Microsoft\Teams\Update.exe\" --processStart \"Teams.exe\" --process-start-args \"--system-initiated\"" | rex field=input "^(?:[^\s]* ){2}\"(?&lt;process&gt;[^ ]+)\"" </CODE></PRE> Mon, 01 Jul 2019 06:52:57 GMT https://community.splunk.com/t5/Splunk-Search/Need-to-write-both-rex-and-regex/m-p/452803#M128193 jawaharas 2019-07-01T06:52:57Z Re: Need to write both rex and regex https://community.splunk.com/t5/Splunk-Search/Need-to-write-both-rex-and-regex/m-p/452804#M128194 <P>This worked. Thanks a lot</P> Mon, 01 Jul 2019 07:02:09 GMT https://community.splunk.com/t5/Splunk-Search/Need-to-write-both-rex-and-regex/m-p/452804#M128194 vishwanadhan_mu 2019-07-01T07:02:09Z Re: Need to write both rex and regex https://community.splunk.com/t5/Splunk-Search/Need-to-write-both-rex-and-regex/m-p/452805#M128195 <P>This too worked for me. Thanks a lot.</P> Mon, 01 Jul 2019 07:03:50 GMT https://community.splunk.com/t5/Splunk-Search/Need-to-write-both-rex-and-regex/m-p/452805#M128195 vishwanadhan_mu 2019-07-01T07:03:50Z Re: Need to write both rex and regex https://community.splunk.com/t5/Splunk-Search/Need-to-write-both-rex-and-regex/m-p/452806#M128196 <P>If you don't mind can you explain me [^--]+)\"" this part</P> Mon, 01 Jul 2019 07:14:59 GMT https://community.splunk.com/t5/Splunk-Search/Need-to-write-both-rex-and-regex/m-p/452806#M128196 vishwanadhan_mu 2019-07-01T07:14:59Z Re: Need to write both rex and regex https://community.splunk.com/t5/Splunk-Search/Need-to-write-both-rex-and-regex/m-p/452807#M128197 <P>I mentioned to extract from processStart to before -- </P> Mon, 01 Jul 2019 07:18:40 GMT https://community.splunk.com/t5/Splunk-Search/Need-to-write-both-rex-and-regex/m-p/452807#M128197 vnravikumar 2019-07-01T07:18:40Z