https://community.splunk.com/t5/Splunk-Search/How-to-get-ptime-from-below-string/m-p/433709#M171635 <P>This is the below error : 'ptime:(?\w+)': Regex: unrecognized character after (? or (?-</P> Mon, 29 Apr 2019 07:54:19 GMT Veeruswathi 2019-04-29T07:54:19Z https://community.splunk.com/t5/Splunk-Search/How-to-get-ptime-from-below-string/m-p/433706#M171632 <P>Hi , </P> <P>Below is my field "rtpmap:8 PCMA/8000,rtpmap:101 telephone-event/8000,ptime:20" I would like to get ptime from this , which is 20 . But sometimes i have the field coming as maxptime instead of ptime </P> <P>Please help</P> <P>Thanks,<BR /> Swathi</P> Mon, 29 Apr 2019 07:34:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-ptime-from-below-string/m-p/433706#M171632 Veeruswathi 2019-04-29T07:34:05Z https://community.splunk.com/t5/Splunk-Search/How-to-get-ptime-from-below-string/m-p/433707#M171633 <P>@veeruswathi</P> <P>try this:<BR /> | makeresults | eval test="rtpmap:8 PCMA/8000,rtpmap:101 telephone-event/8000,ptime:20" | rex field=test "ptime:(?<PTIME>\w+)"</PTIME></P> Mon, 29 Apr 2019 07:44:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-ptime-from-below-string/m-p/433707#M171633 vishaltaneja070 2019-04-29T07:44:41Z https://community.splunk.com/t5/Splunk-Search/How-to-get-ptime-from-below-string/m-p/433708#M171634 <P>Hi</P> <P>Give a try</P> <PRE><CODE>| makeresults | eval msg="rtpmap:8 PCMA/8000,rtpmap:101 telephone-event/8000,maxptime:20" | makemv delim="," msg | rex field=msg "(ptime:|maxptime:)(?P&lt;ptime&gt;\d+)" </CODE></PRE> Mon, 29 Apr 2019 07:53:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-ptime-from-below-string/m-p/433708#M171634 vnravikumar 2019-04-29T07:53:38Z https://community.splunk.com/t5/Splunk-Search/How-to-get-ptime-from-below-string/m-p/433709#M171635 <P>This is the below error : 'ptime:(?\w+)': Regex: unrecognized character after (? or (?-</P> Mon, 29 Apr 2019 07:54:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-ptime-from-below-string/m-p/433709#M171635 Veeruswathi 2019-04-29T07:54:19Z https://community.splunk.com/t5/Splunk-Search/How-to-get-ptime-from-below-string/m-p/433710#M171636 <P>Awesome!! </P> Mon, 29 Apr 2019 07:59:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-ptime-from-below-string/m-p/433710#M171636 Veeruswathi 2019-04-29T07:59:05Z https://community.splunk.com/t5/Splunk-Search/How-to-get-ptime-from-below-string/m-p/433711#M171637 <P>Why not just use extract?</P> <PRE><CODE>| makeresults | eval _raw="rtpmap:8 PCMA/8000,rtpmap:101 telephone-event/8000,maxptime:20,ptime:20" | extract pairdelim=",", kvdelim=":" mv_add=t </CODE></PRE> Mon, 29 Apr 2019 16:11:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-ptime-from-below-string/m-p/433711#M171637 jason_prondak 2019-04-29T16:11:06Z