https://community.splunk.com/t5/Splunk-Search/Return-string-and-number-before-and-after-equals-sign/m-p/327330#M161743 <P>Hi,</P> <P>I am new in splunk and i want to save the value in fields before and after =</P> <P>for example events look like below <BR /> rollnumber=34556<BR /> class=12</P> <P>I want to return rollnumber and class in first field and the number after = in second field. </P> <P>base search | rex max_match=15 field=_raw "(?P)<A href="https://community.splunk.com/?P" target="_blank">=</A>"<BR /><BR /> this doesnt work, both values are coming as space. </P> Tue, 29 Sep 2020 18:58:40 GMT soumyajk 2020-09-29T18:58:40Z https://community.splunk.com/t5/Splunk-Search/Return-string-and-number-before-and-after-equals-sign/m-p/327330#M161743 <P>Hi,</P> <P>I am new in splunk and i want to save the value in fields before and after =</P> <P>for example events look like below <BR /> rollnumber=34556<BR /> class=12</P> <P>I want to return rollnumber and class in first field and the number after = in second field. </P> <P>base search | rex max_match=15 field=_raw "(?P)<A href="https://community.splunk.com/?P" target="_blank">=</A>"<BR /><BR /> this doesnt work, both values are coming as space. </P> Tue, 29 Sep 2020 18:58:40 GMT https://community.splunk.com/t5/Splunk-Search/Return-string-and-number-before-and-after-equals-sign/m-p/327330#M161743 soumyajk 2020-09-29T18:58:40Z https://community.splunk.com/t5/Splunk-Search/Return-string-and-number-before-and-after-equals-sign/m-p/327331#M161744 <P>Your regex seems to be incomplete, could you try:</P> <PRE><CODE>| rex max_match=15 field=_raw "(?P&lt;field1&gt;\w+)\=(?P&lt;field2&gt;\w+)" </CODE></PRE> Wed, 11 Apr 2018 16:01:39 GMT https://community.splunk.com/t5/Splunk-Search/Return-string-and-number-before-and-after-equals-sign/m-p/327331#M161744 damien_chillet 2018-04-11T16:01:39Z