https://community.splunk.com/t5/Splunk-Search/Extract-one-word/m-p/513831#M144207 <P>Hello,&nbsp;</P><P>How can I extract <STRONG>debitsksvrvru7</STRONG> from this query:</P><P><SPAN>sndb(1p_debitsksvrvru/-363877568/localhost_<STRONG>debitsksvrvru7</STRONG>)pass:len=152</SPAN></P><P><SPAN>field name= Description</SPAN></P><P><SPAN>thank you</SPAN></P> Thu, 13 Aug 2020 02:47:23 GMT edfigue 2020-08-13T02:47:23Z https://community.splunk.com/t5/Splunk-Search/Extract-one-word/m-p/513831#M144207 <P>Hello,&nbsp;</P><P>How can I extract <STRONG>debitsksvrvru7</STRONG> from this query:</P><P><SPAN>sndb(1p_debitsksvrvru/-363877568/localhost_<STRONG>debitsksvrvru7</STRONG>)pass:len=152</SPAN></P><P><SPAN>field name= Description</SPAN></P><P><SPAN>thank you</SPAN></P> Thu, 13 Aug 2020 02:47:23 GMT https://community.splunk.com/t5/Splunk-Search/Extract-one-word/m-p/513831#M144207 edfigue 2020-08-13T02:47:23Z https://community.splunk.com/t5/Splunk-Search/Extract-one-word/m-p/513841#M144210 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/224928">@edfigue</a>,<BR /><BR />If the string looks similiar all the time, you could do it on searchtime with <EM>rex:</EM></P><P>&nbsp;</P><LI-CODE lang="markup">| rex field=Description "\/localhost\_(?&lt;new_field&gt;\S*)\)"</LI-CODE><P>&nbsp;</P><P><BR />If it is not&nbsp;everytime "localhost_" in front of the data you need you would have to change it to something more generic.<BR /><BR />Hope it gives you an idea.<BR />BR<BR />Ralph<BR /><BR />--<BR /><EM>Karma and/or Solution tagging appreciated.</EM><BR /><BR /><BR /></P> Thu, 13 Aug 2020 07:47:36 GMT https://community.splunk.com/t5/Splunk-Search/Extract-one-word/m-p/513841#M144210 rnowitzki 2020-08-13T07:47:36Z https://community.splunk.com/t5/Splunk-Search/Extract-one-word/m-p/514014#M144271 <P>Thank you, that works!! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span>&nbsp;</P> Fri, 14 Aug 2020 02:27:23 GMT https://community.splunk.com/t5/Splunk-Search/Extract-one-word/m-p/514014#M144271 edfigue 2020-08-14T02:27:23Z