https://community.splunk.com/t5/Splunk-Search/Regex-Help/m-p/529772#M149654 <P>Please help create a Regex that will only take the 4 characters/number after MTCP from below events?</P><P>For example below, the regex should pick up YUM3, WOPP, WOLG.</P><P><SPAN>/XXX/XXXXX/XXXX/XXXXX/MFG_MTCPYUM3..XX_YUM3_XXXX</SPAN></P><P><SPAN>/XXX/XXXXX/XXXX/XXXXX/MFG_MTCPWOPP..XX_WOPP_XXXX</SPAN></P><P><SPAN>/XXX/XXXXX/XXXX/XXXXX/MFG_MTCPWOLG..XX_WOLG_XXXX</SPAN></P><P>Thanks</P> Tue, 17 Nov 2020 15:14:58 GMT jboustead 2020-11-17T15:14:58Z https://community.splunk.com/t5/Splunk-Search/Regex-Help/m-p/529772#M149654 <P>Please help create a Regex that will only take the 4 characters/number after MTCP from below events?</P><P>For example below, the regex should pick up YUM3, WOPP, WOLG.</P><P><SPAN>/XXX/XXXXX/XXXX/XXXXX/MFG_MTCPYUM3..XX_YUM3_XXXX</SPAN></P><P><SPAN>/XXX/XXXXX/XXXX/XXXXX/MFG_MTCPWOPP..XX_WOPP_XXXX</SPAN></P><P><SPAN>/XXX/XXXXX/XXXX/XXXXX/MFG_MTCPWOLG..XX_WOLG_XXXX</SPAN></P><P>Thanks</P> Tue, 17 Nov 2020 15:14:58 GMT https://community.splunk.com/t5/Splunk-Search/Regex-Help/m-p/529772#M149654 jboustead 2020-11-17T15:14:58Z https://community.splunk.com/t5/Splunk-Search/Regex-Help/m-p/529775#M149656 <LI-CODE lang="markup">| rex "MTCP(?&lt;field&gt;\w{4})"</LI-CODE> Tue, 17 Nov 2020 15:19:14 GMT https://community.splunk.com/t5/Splunk-Search/Regex-Help/m-p/529775#M149656 ITWhisperer 2020-11-17T15:19:14Z