https://community.splunk.com/t5/Splunk-Search/need-help-in-extracting-a-substring-from-a-string/m-p/484052#M140387 <P>Pipe your existing search to erex, give the field a name and provide an example.</P> <PRE><CODE>...| erex ServiceState examples="running state" </CODE></PRE> <P>When your search completes use the job inspector to find the regex that Splunk used to find your match.</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Erex">https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Erex</A></P> Tue, 28 Apr 2020 16:40:54 GMT codebuilder 2020-04-28T16:40:54Z https://community.splunk.com/t5/Splunk-Search/need-help-in-extracting-a-substring-from-a-string/m-p/484051#M140386 <P>hello splunkers! new to splunk and i am needing to extract a word from a message field.</P> <P>this is the message</P> <P>The Cluster Service service entered the running state.</P> <P>i want to extract "running state" and use it to indicate a status of a server.</P> <P>thank you!</P> Sun, 07 Jun 2020 01:51:59 GMT https://community.splunk.com/t5/Splunk-Search/need-help-in-extracting-a-substring-from-a-string/m-p/484051#M140386 owie6466 2020-06-07T01:51:59Z https://community.splunk.com/t5/Splunk-Search/need-help-in-extracting-a-substring-from-a-string/m-p/484052#M140387 <P>Pipe your existing search to erex, give the field a name and provide an example.</P> <PRE><CODE>...| erex ServiceState examples="running state" </CODE></PRE> <P>When your search completes use the job inspector to find the regex that Splunk used to find your match.</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Erex">https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Erex</A></P> Tue, 28 Apr 2020 16:40:54 GMT https://community.splunk.com/t5/Splunk-Search/need-help-in-extracting-a-substring-from-a-string/m-p/484052#M140387 codebuilder 2020-04-28T16:40:54Z https://community.splunk.com/t5/Splunk-Search/need-help-in-extracting-a-substring-from-a-string/m-p/484053#M140388 <P>thanks! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 28 Apr 2020 16:49:28 GMT https://community.splunk.com/t5/Splunk-Search/need-help-in-extracting-a-substring-from-a-string/m-p/484053#M140388 owie6466 2020-04-28T16:49:28Z https://community.splunk.com/t5/Splunk-Search/need-help-in-extracting-a-substring-from-a-string/m-p/484054#M140389 <P>this worked great!!!!!!</P> Tue, 28 Apr 2020 16:55:43 GMT https://community.splunk.com/t5/Splunk-Search/need-help-in-extracting-a-substring-from-a-string/m-p/484054#M140389 owie6466 2020-04-28T16:55:43Z https://community.splunk.com/t5/Splunk-Search/need-help-in-extracting-a-substring-from-a-string/m-p/484055#M140390 <P>Glad it worked for you! erex is a hidden gem <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 28 Apr 2020 16:58:19 GMT https://community.splunk.com/t5/Splunk-Search/need-help-in-extracting-a-substring-from-a-string/m-p/484055#M140390 codebuilder 2020-04-28T16:58:19Z