https://community.splunk.com/t5/Splunk-Search/How-to-extract-part-of-a-text-from-log-events/m-p/341229#M159608 <P>will something like this work?</P> <PRE><CODE>device_(?&lt;volumeName&gt;.*)_1_vol </CODE></PRE> Wed, 02 Aug 2017 12:45:10 GMT cmerriman 2017-08-02T12:45:10Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-part-of-a-text-from-log-events/m-p/341228#M159607 <P>I am very new to regex and I need to extract anything that comes between "device_" and "_1_vol" as volume name. </P> <P>"device_array02_im-wxs-vb004_p2_lun_215_1_vol<BR /> "device_array03_serverb_p2_lun_139_1_vol"</P> <P>The below output is from the actual log</P> <P>"Alert 0202 : The Read Latency of array Volume : device_array02_im-wxs-vb004_p2_lun_215_1_vol is at 125717.0 us"</P> <P>I tried word boundaries but it's not working. Can someone please help me?</P> <P>"(?P\bdevice\w+\b)_1_vol"</P> Tue, 29 Sep 2020 15:08:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-part-of-a-text-from-log-events/m-p/341228#M159607 jerin1982 2020-09-29T15:08:22Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-part-of-a-text-from-log-events/m-p/341229#M159608 <P>will something like this work?</P> <PRE><CODE>device_(?&lt;volumeName&gt;.*)_1_vol </CODE></PRE> Wed, 02 Aug 2017 12:45:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-part-of-a-text-from-log-events/m-p/341229#M159608 cmerriman 2017-08-02T12:45:10Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-part-of-a-text-from-log-events/m-p/341230#M159609 <P>Hi, I can't really provide the specific regex code for you. But just incase you find suggestions, you can try it out here: <A href="http://regexr.com/">http://regexr.com/</A><BR /> Just paste your samples and see if their regex code works.</P> <P>And since you are also starting to learn regex like me, that site also provide information on how to use regex.</P> Wed, 02 Aug 2017 14:04:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-part-of-a-text-from-log-events/m-p/341230#M159609 bonnlbbelandres 2017-08-02T14:04:58Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-part-of-a-text-from-log-events/m-p/341231#M159610 <P>Thank you so much. It worked perfectly.</P> Wed, 02 Aug 2017 14:36:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-part-of-a-text-from-log-events/m-p/341231#M159610 jerin1982 2017-08-02T14:36:05Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-part-of-a-text-from-log-events/m-p/341232#M159611 <P>Thank you. I will look into it.</P> Wed, 02 Aug 2017 14:36:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-part-of-a-text-from-log-events/m-p/341232#M159611 jerin1982 2017-08-02T14:36:46Z