https://community.splunk.com/t5/Splunk-Search/Field-extraction-query/m-p/67221#M16798 <P>Any pointers on how to extract the third field <BR /> Event1: <FIELD1> <FIELD2> &lt;<FIELD3>&gt; <FIELD4> <BR /> Event2: <FIELD1> <FIELD2> <FIELD3> <FIELD4> <BR /> the third field is populated with double &lt;&lt;&gt;&gt; and sometimes with single &lt;&gt;.</FIELD4></FIELD3></FIELD2></FIELD1></FIELD4></FIELD3></FIELD2></FIELD1></P> <P>regex for double&lt;&lt;&gt;&gt;</P> <PRE><CODE>\s+&lt;([^&gt;]+\&gt;)&gt; </CODE></PRE> <P>regex for single &lt;&gt;</P> <PRE><CODE>\s+&lt;([^&gt;]+) </CODE></PRE> <P>how to combine both?</P> Wed, 20 Mar 2013 08:09:14 GMT p_basanth 2013-03-20T08:09:14Z https://community.splunk.com/t5/Splunk-Search/Field-extraction-query/m-p/67221#M16798 <P>Any pointers on how to extract the third field <BR /> Event1: <FIELD1> <FIELD2> &lt;<FIELD3>&gt; <FIELD4> <BR /> Event2: <FIELD1> <FIELD2> <FIELD3> <FIELD4> <BR /> the third field is populated with double &lt;&lt;&gt;&gt; and sometimes with single &lt;&gt;.</FIELD4></FIELD3></FIELD2></FIELD1></FIELD4></FIELD3></FIELD2></FIELD1></P> <P>regex for double&lt;&lt;&gt;&gt;</P> <PRE><CODE>\s+&lt;([^&gt;]+\&gt;)&gt; </CODE></PRE> <P>regex for single &lt;&gt;</P> <PRE><CODE>\s+&lt;([^&gt;]+) </CODE></PRE> <P>how to combine both?</P> Wed, 20 Mar 2013 08:09:14 GMT https://community.splunk.com/t5/Splunk-Search/Field-extraction-query/m-p/67221#M16798 p_basanth 2013-03-20T08:09:14Z https://community.splunk.com/t5/Splunk-Search/Field-extraction-query/m-p/67222#M16799 <P>First of all it seems your regex for double brackets is incorrect? Unless you want to match the inner brackets...I'm assuming this is what you want in my answer.</P> <P>How about</P> <PRE><CODE>\s+&lt;(.+?&gt;*)&gt; </CODE></PRE> Wed, 20 Mar 2013 08:46:23 GMT https://community.splunk.com/t5/Splunk-Search/Field-extraction-query/m-p/67222#M16799 Ayn 2013-03-20T08:46:23Z