https://community.splunk.com/t5/Splunk-Search/Look-at-value-ahead-of-string-and-table-it/m-p/552991#M156967 <P>I have events in my logs. I want to capture "temp" and table it<BR />received_time="2021-05-25T15:51:22.181+00:00"] 37 pollAcu20:830 ACU: PSU: Connected: true Output voltage: 4775 0.01V, Output current: 36 0.01A <STRONG>Critical temp: 426 0.1 Deg C</STRONG> Status: 0x3 Fault: false</P> Tue, 25 May 2021 16:32:39 GMT ekucevic 2021-05-25T16:32:39Z https://community.splunk.com/t5/Splunk-Search/Look-at-value-ahead-of-string-and-table-it/m-p/552991#M156967 <P>I have events in my logs. I want to capture "temp" and table it<BR />received_time="2021-05-25T15:51:22.181+00:00"] 37 pollAcu20:830 ACU: PSU: Connected: true Output voltage: 4775 0.01V, Output current: 36 0.01A <STRONG>Critical temp: 426 0.1 Deg C</STRONG> Status: 0x3 Fault: false</P> Tue, 25 May 2021 16:32:39 GMT https://community.splunk.com/t5/Splunk-Search/Look-at-value-ahead-of-string-and-table-it/m-p/552991#M156967 ekucevic 2021-05-25T16:32:39Z https://community.splunk.com/t5/Splunk-Search/Look-at-value-ahead-of-string-and-table-it/m-p/553001#M156968 <P>As suggested by the "rex" label, the rex command can help.</P><LI-CODE lang="markup">... | rex "Critical temp: (?&lt;temp&gt;.*?) Deg" | table temp</LI-CODE> Tue, 25 May 2021 17:29:43 GMT https://community.splunk.com/t5/Splunk-Search/Look-at-value-ahead-of-string-and-table-it/m-p/553001#M156968 richgalloway 2021-05-25T17:29:43Z