https://community.splunk.com/t5/Splunk-Search/help-regex/m-p/442189#M168991 <P>hello<BR /> in a log file i want to extract every tetx which starts with EU\SH but i dont succeed<BR /> could you help me please??</P> Sun, 10 Jun 2018 06:02:33 GMT jip31 2018-06-10T06:02:33Z https://community.splunk.com/t5/Splunk-Search/help-regex/m-p/442189#M168991 <P>hello<BR /> in a log file i want to extract every tetx which starts with EU\SH but i dont succeed<BR /> could you help me please??</P> Sun, 10 Jun 2018 06:02:33 GMT https://community.splunk.com/t5/Splunk-Search/help-regex/m-p/442189#M168991 jip31 2018-06-10T06:02:33Z https://community.splunk.com/t5/Splunk-Search/help-regex/m-p/442190#M168992 <P>Could you please provide raw event to understand better.<BR /> Any ways you can use <CODE>|</CODE>"OR" between EU and SH in regex</P> <PRE><CODE>...|rex "EU|SH(?&lt;string&gt;\w+)" </CODE></PRE> Sun, 10 Jun 2018 06:48:17 GMT https://community.splunk.com/t5/Splunk-Search/help-regex/m-p/442190#M168992 493669 2018-06-10T06:48:17Z https://community.splunk.com/t5/Splunk-Search/help-regex/m-p/442191#M168993 <P>perfect it works thanks</P> Mon, 11 Jun 2018 04:11:39 GMT https://community.splunk.com/t5/Splunk-Search/help-regex/m-p/442191#M168993 jip31 2018-06-11T04:11:39Z https://community.splunk.com/t5/Splunk-Search/help-regex/m-p/442192#M168994 <P>@jip31 please accept the answer if your issue is resolved.</P> <P>@493669, please use the code button <CODE>101010</CODE>, while posting code so that special characters do not escape on Splunk Answers.</P> Mon, 11 Jun 2018 06:37:49 GMT https://community.splunk.com/t5/Splunk-Search/help-regex/m-p/442192#M168994 niketn 2018-06-11T06:37:49Z