https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-severity-value-from-the-events-with-different/m-p/312787#M160118 <P>try this</P> <P>your base search | rex field=test "\d+-\d+-\d+\s\d+:\d+:\d+.\d+\S+.*(?P(DEBUG|INFO))"</P> Thu, 13 Jul 2017 15:54:31 GMT sbbadri 2017-07-13T15:54:31Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-severity-value-from-the-events-with-different/m-p/312786#M160117 <P>For example - I have the below different types of events under same index, all i need from this is the INFO, DEBUG, ERROR etc.(highlighted ones)</P> <P>2017-07-11 16:01:52.9853 [10] [host-name] [Rabc.Gtgefsefwe.Sefwerg.werwer] <STRONG>DEBUG</STRONG>: erwer.wer.Sla.wer.wer.dfgdfg, gfh job. <BR /> 2017-07-13 16:28:48.7464 [16] sdfsdgsdg.werwer.werwerewr <STRONG>DEBUG</STRONG>: Bath erwerwer of 1 triggers <BR /> 2017-07-13 16:28:47.1820 [5] [hodt-name] Rewerwerg.Dal.tweewtert.ert.ertertertertert`2[[erterting.wsdfsddswwsssjects.sdfsggdg.Dtos.rrtrtw.UsefvbchdftrrtInfoDto, Rttererkng.sdfsdfsdfsdfsdf.weqwrerewt, Version=1.0.0.1, Cuure=neutral, PublicKeyToken=null],[wertwerwng.Data.werwer.werwer.User, rwertwerwe.Data.vgdfgdfg, Version=1.0.6372.25861, Culture=neutral, PublicKeyToken=null]]] <STRONG>INFO</STRONG>: No records to process. No Bulk insert of Entity: dfgdfgdfg.Data.dfgdfg.EntityModels.User is required.</P> Thu, 13 Jul 2017 15:36:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-severity-value-from-the-events-with-different/m-p/312786#M160117 shanmugavelv 2017-07-13T15:36:59Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-severity-value-from-the-events-with-different/m-p/312787#M160118 <P>try this</P> <P>your base search | rex field=test "\d+-\d+-\d+\s\d+:\d+:\d+.\d+\S+.*(?P(DEBUG|INFO))"</P> Thu, 13 Jul 2017 15:54:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-severity-value-from-the-events-with-different/m-p/312787#M160118 sbbadri 2017-07-13T15:54:31Z