https://community.splunk.com/t5/Splunk-Search/Splunk-dashboard/m-p/550315#M156165 <LI-CODE lang="markup">| makeresults | eval _raw="ABCD" | appendpipe [ eval _raw="DABC" | appendpipe [ eval _raw="CBAB"]] ``` this is sample data ``` | eval _raw=split(_raw,"") | rex ("?&lt;yourData&gt;A")</LI-CODE><P>If the data has features, it can be extracted using regular expressions.</P> Tue, 04 May 2021 02:53:14 GMT to4kawa 2021-05-04T02:53:14Z https://community.splunk.com/t5/Splunk-Search/Splunk-dashboard/m-p/550228#M156137 <P>Hi Team</P><P>I have the required data in one of the fields but the logs are not in order how can i extract the required data. Below is the example of how it looks</P><P>row1 --&gt;&nbsp; &nbsp;A<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; B<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; C<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; D</P><P><BR />row2 --&gt;&nbsp; &nbsp;D<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;A<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;B<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;C<BR /><BR />row3--&gt;&nbsp; &nbsp; C<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;D<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;A<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;B<BR /><BR />im trying to extract the data using mvindex<BR />| eval x= mvindex(split(planname,"\n"),2) | table x --&gt; Since in index 2nd position for all the rows the data is different so im unable to view the correct data.</P><P>Please let me know the query to extract the data<BR /><BR />Thanks<BR /><BR /><BR /></P> Mon, 03 May 2021 13:47:59 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-dashboard/m-p/550228#M156137 Nith1 2021-05-03T13:47:59Z https://community.splunk.com/t5/Splunk-Search/Splunk-dashboard/m-p/550315#M156165 <LI-CODE lang="markup">| makeresults | eval _raw="ABCD" | appendpipe [ eval _raw="DABC" | appendpipe [ eval _raw="CBAB"]] ``` this is sample data ``` | eval _raw=split(_raw,"") | rex ("?&lt;yourData&gt;A")</LI-CODE><P>If the data has features, it can be extracted using regular expressions.</P> Tue, 04 May 2021 02:53:14 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-dashboard/m-p/550315#M156165 to4kawa 2021-05-04T02:53:14Z