topic Re: How to extract a word from raw data in Splunk using rex in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-word-from-raw-data-in-Splunk-using-rex/m-p/463914#M130779 <P>ok Thank you so much. Will check on it:)</P> Tue, 22 Oct 2019 04:56:05 GMT kavyamohan 2019-10-22T04:56:05Z How to extract a word from raw data in Splunk using rex https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-word-from-raw-data-in-Splunk-using-rex/m-p/463910#M130775 <P>SVSCPLEX,S0W1,S0W1.DAL-EBIS.IHOST.COM,SYSLOG,zOS-SYSLOG-Console,SYSLOG,-0400,NE,001C,19283 01.21.46.880 -0500,S0W1 ,JOB03487, ,40000000000000000000000000000000,00000090,TESCREAT,00," IEF450I TESCREAT STEP010 - ABEND=S222 U0000 REASON=00000000"\n. I want to extract this TESCREAT from the above given. I was able to write rex, but iam getting error while using the below rex field. Can you help me where I am missing.</P> <P>| rex field=_raw ^[^"\n]*"\s+\w+\d+\w+\s+(?P\w+)</P> Mon, 21 Oct 2019 09:25:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-word-from-raw-data-in-Splunk-using-rex/m-p/463910#M130775 kavyamohan 2019-10-21T09:25:02Z Re: How to extract a word from raw data in Splunk using rex https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-word-from-raw-data-in-Splunk-using-rex/m-p/463911#M130776 <P>Hi kavyamohan,<BR /> try this</P> <PRE><CODE>| rex "([^,]*,){15}(?&lt;my_field&gt;[^,]*)," </CODE></PRE> <P>you can test it at <A href="https://regex101.com/r/Dul1S5/1">https://regex101.com/r/Dul1S5/1</A></P> <P>ciao.<BR /> Giuseppe</P> Mon, 21 Oct 2019 10:47:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-word-from-raw-data-in-Splunk-using-rex/m-p/463911#M130776 gcusello 2019-10-21T10:47:56Z Re: How to extract a word from raw data in Splunk using rex https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-word-from-raw-data-in-Splunk-using-rex/m-p/463912#M130777 <P>Thank you so much. It worked, where can I practice and learn writing rex?</P> Mon, 21 Oct 2019 10:58:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-word-from-raw-data-in-Splunk-using-rex/m-p/463912#M130777 kavyamohan 2019-10-21T10:58:53Z Re: How to extract a word from raw data in Splunk using rex https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-word-from-raw-data-in-Splunk-using-rex/m-p/463913#M130778 <P>Hi kavyamohan,<BR /> you can use regex101 to test your regexes and this is the most important site to use!<BR /> .<BR /> About a tutorial, you can search on Internet using Google, anyway I used this <A href="https://www.regular-expressions.info/">https://www.regular-expressions.info/</A></P> <P>If you want a quick reference guide (very quick for regexes but there are many information also on Splunk), you can use <A href="https://www.splunk.com/pdfs/solution-guides/splunk-quick-reference-guide.pdf">https://www.splunk.com/pdfs/solution-guides/splunk-quick-reference-guide.pdf</A> .</P> <P>Ciao.<BR /> Giuseppe</P> Mon, 21 Oct 2019 12:46:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-word-from-raw-data-in-Splunk-using-rex/m-p/463913#M130778 gcusello 2019-10-21T12:46:50Z Re: How to extract a word from raw data in Splunk using rex https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-word-from-raw-data-in-Splunk-using-rex/m-p/463914#M130779 <P>ok Thank you so much. Will check on it:)</P> Tue, 22 Oct 2019 04:56:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-word-from-raw-data-in-Splunk-using-rex/m-p/463914#M130779 kavyamohan 2019-10-22T04:56:05Z