https://community.splunk.com/t5/Splunk-Search/extract-number-from-a-field-and-output-to-a-table-or-new-field/m-p/452590#M167608 <P>If I understand your question correctly, this should get you started.</P> <PRE><CODE>... | rex field=field3 "Printed\s*:\s*(?&lt;Printed&gt;\d+)" | ... </CODE></PRE> Sun, 09 Sep 2018 18:03:34 GMT richgalloway 2018-09-09T18:03:34Z https://community.splunk.com/t5/Splunk-Search/extract-number-from-a-field-and-output-to-a-table-or-new-field/m-p/452589#M167607 <P>i am trying to extract the Printed number value from the below string deriving from field3 and out put to a table or new field known as 'Printed'</P> <H1>Summary:</H1> <P>Selected: : 001558<BR /> Deceased : 000003<BR /> GoneAway : 000007<BR /> Suspended : 000023<BR /> Sent2Print : 001527<BR /> ===== : ===<BR /> Printed : 001527<BR /> ===== : ===</P> Sun, 09 Sep 2018 14:11:28 GMT https://community.splunk.com/t5/Splunk-Search/extract-number-from-a-field-and-output-to-a-table-or-new-field/m-p/452589#M167607 bablucho 2018-09-09T14:11:28Z https://community.splunk.com/t5/Splunk-Search/extract-number-from-a-field-and-output-to-a-table-or-new-field/m-p/452590#M167608 <P>If I understand your question correctly, this should get you started.</P> <PRE><CODE>... | rex field=field3 "Printed\s*:\s*(?&lt;Printed&gt;\d+)" | ... </CODE></PRE> Sun, 09 Sep 2018 18:03:34 GMT https://community.splunk.com/t5/Splunk-Search/extract-number-from-a-field-and-output-to-a-table-or-new-field/m-p/452590#M167608 richgalloway 2018-09-09T18:03:34Z https://community.splunk.com/t5/Splunk-Search/extract-number-from-a-field-and-output-to-a-table-or-new-field/m-p/452591#M167609 <P>This should auto-extract at searchtime. If not then try adding this to your search</P> <PRE><CODE>| rex field=field3 Printed\s\:\s(?&lt;Printed&gt;\d+) | table Printed </CODE></PRE> Sun, 09 Sep 2018 18:20:23 GMT https://community.splunk.com/t5/Splunk-Search/extract-number-from-a-field-and-output-to-a-table-or-new-field/m-p/452591#M167609 skoelpin 2018-09-09T18:20:23Z https://community.splunk.com/t5/Splunk-Search/extract-number-from-a-field-and-output-to-a-table-or-new-field/m-p/452592#M167610 <P>actually its not in a field 3...<BR /> the below is an extract from an event. when I try to manually extract it does not show the full event past line 18 so I thought maybe a regex will be able to pull the data 'Printed: &lt;001527&gt; <BR /> Selected: : 001558<BR /> Deceased : 000003<BR /> GoneAway : 000007<BR /> Suspended : 000023<BR /> Sent2Print : 001527<BR /> ===== : ===<BR /> Printed : 001527<BR /> ===== : ===</P> Thu, 20 Sep 2018 15:33:09 GMT https://community.splunk.com/t5/Splunk-Search/extract-number-from-a-field-and-output-to-a-table-or-new-field/m-p/452592#M167610 bablucho 2018-09-20T15:33:09Z