https://community.splunk.com/t5/Splunk-Search/Need-help-with-rex-command/m-p/469951#M132261 <PRE><CODE>|rex "(?&lt;youWant&gt;\d{5,})" </CODE></PRE> Mon, 10 Feb 2020 22:08:56 GMT to4kawa 2020-02-10T22:08:56Z https://community.splunk.com/t5/Splunk-Search/Need-help-with-rex-command/m-p/469950#M132260 <P>Hello I'm trying to run a rex command to extract "is set to expire" </P> <P>Relying party trust 'ButterCup Games - Test'<BR /> xxxxx: Signing certificate with thumbprint '1111111111111111111111' is set to expire on 2/13/2020 6:59:59 PM.</P> Mon, 10 Feb 2020 21:41:52 GMT https://community.splunk.com/t5/Splunk-Search/Need-help-with-rex-command/m-p/469950#M132260 locose 2020-02-10T21:41:52Z https://community.splunk.com/t5/Splunk-Search/Need-help-with-rex-command/m-p/469951#M132261 <PRE><CODE>|rex "(?&lt;youWant&gt;\d{5,})" </CODE></PRE> Mon, 10 Feb 2020 22:08:56 GMT https://community.splunk.com/t5/Splunk-Search/Need-help-with-rex-command/m-p/469951#M132261 to4kawa 2020-02-10T22:08:56Z https://community.splunk.com/t5/Splunk-Search/Need-help-with-rex-command/m-p/469952#M132262 <P>Hi</P> <P>If you want to extract date/time, please try the following</P> <PRE><CODE>| makeresults | eval temp="xxxxx: Signing certificate with thumbprint '1111111111111111111111' is set to expire on 2/13/2020 6:59:59 PM." | rex field=temp "set to expire on\s(?P&lt;expireon&gt;\d{1,2}\/\d{1,2}\/\d{4}\s\d{1,2}\:\d{1,2}\:\d{1,2}\s(AM|PM))" </CODE></PRE> Tue, 11 Feb 2020 01:54:04 GMT https://community.splunk.com/t5/Splunk-Search/Need-help-with-rex-command/m-p/469952#M132262 vnravikumar 2020-02-11T01:54:04Z