https://community.splunk.com/t5/Splunk-Search/Need-help-to-grep-for-a-string-from-a-search-query/m-p/334164#M175287 <P>This will extract the last digits before the <CODE>HTTP/1.1</CODE> and the field name will be <CODE>Digits</CODE></P> <P><CODE>... rex | (?&lt;Digits&gt;\d+)\sHTTP\/1\.1</CODE></P> Fri, 03 Mar 2017 13:03:52 GMT skoelpin 2017-03-03T13:03:52Z https://community.splunk.com/t5/Splunk-Search/Need-help-to-grep-for-a-string-from-a-search-query/m-p/334163#M175286 <P>Below is the sample result i get after running a query.</P> <PRE><CODE>Mar 2 19:38:25 myhost apache2: "123.12.13.14" - - [02/Mar/2017:19:38:25 +0000] "POST /here/is/my/url?p=12345a-12d-12e-12r-123456&amp;t=1111ea-11c1-111e-111c-1111111-99999999 HTTP/1.1" http_status_code=500 http_response_bytes=291 http_referer="-" http_user_agent="Java1.6.0_75" http_response_time=6526 http_ttfb=6439 </CODE></PRE> <P>I need to extract that 9999999 ( after those 1111's) and list out in a separate field.I am finding difficult time to use rex in Splunk.Somebody please help me out here.</P> Thu, 02 Mar 2017 23:19:27 GMT https://community.splunk.com/t5/Splunk-Search/Need-help-to-grep-for-a-string-from-a-search-query/m-p/334163#M175286 chetanhonnavile 2017-03-02T23:19:27Z https://community.splunk.com/t5/Splunk-Search/Need-help-to-grep-for-a-string-from-a-search-query/m-p/334164#M175287 <P>This will extract the last digits before the <CODE>HTTP/1.1</CODE> and the field name will be <CODE>Digits</CODE></P> <P><CODE>... rex | (?&lt;Digits&gt;\d+)\sHTTP\/1\.1</CODE></P> Fri, 03 Mar 2017 13:03:52 GMT https://community.splunk.com/t5/Splunk-Search/Need-help-to-grep-for-a-string-from-a-search-query/m-p/334164#M175287 skoelpin 2017-03-03T13:03:52Z