topic Re: How to extract the hostname value into a separate field using regex? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-hostname-value-into-a-separate-field-using/m-p/517314#M145471 <P>Ah, this DID work! There was a temporary problem with our data that caused an issue. Thank you!</P> Tue, 01 Sep 2020 17:23:51 GMT mistydennis 2020-09-01T17:23:51Z How to extract the hostname value into a separate field using regex? https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-hostname-value-into-a-separate-field-using/m-p/517098#M145371 <P>Hello - I need help extracting the "hostname" value into a separate field in the following string:</P> <P>&nbsp;</P> <LI-CODE lang="markup">ABC1234: VPN Tunneling: Session started for user with IPv4 address 10.10.10.10, hostname jsmith-1234s</LI-CODE> <P>&nbsp;</P> <P>&nbsp;</P> Tue, 01 Sep 2020 00:01:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-hostname-value-into-a-separate-field-using/m-p/517098#M145371 mistydennis 2020-09-01T00:01:09Z Re: Regex extraction https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-hostname-value-into-a-separate-field-using/m-p/517109#M145377 <P>&nbsp;</P><LI-CODE lang="markup">| rex "hostname (?&lt;hostname&gt;[^\s]*)"</LI-CODE><P>&nbsp;</P> Mon, 31 Aug 2020 19:49:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-hostname-value-into-a-separate-field-using/m-p/517109#M145377 ITWhisperer 2020-08-31T19:49:24Z Re: Regex extraction https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-hostname-value-into-a-separate-field-using/m-p/517110#M145378 <P>That didn't seem to work - no results were produced. The hostname string is within a field called "msg" if that matters (though I tried plugging that in and still can't get results).</P> Mon, 31 Aug 2020 20:00:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-hostname-value-into-a-separate-field-using/m-p/517110#M145378 mistydennis 2020-08-31T20:00:07Z Re: How to extract the hostname value into a separate field using regex? https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-hostname-value-into-a-separate-field-using/m-p/517314#M145471 <P>Ah, this DID work! There was a temporary problem with our data that caused an issue. Thank you!</P> Tue, 01 Sep 2020 17:23:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-hostname-value-into-a-separate-field-using/m-p/517314#M145471 mistydennis 2020-09-01T17:23:51Z