https://community.splunk.com/t5/Splunk-Search/Extract-fields-using-regex/m-p/273094#M176775 <P>Try this</P> <PRE><CODE>(?&lt;msg&gt;ORA-00001:.*?_(?&lt;field&gt;[^\.]+)\..*violated) </CODE></PRE> Fri, 09 Sep 2016 13:05:30 GMT richgalloway 2016-09-09T13:05:30Z https://community.splunk.com/t5/Splunk-Search/Extract-fields-using-regex/m-p/273092#M176773 <P>I have the data like:</P> <P>2016-09-09 06:21:31,858 ... blah ... blah...<BR /> ... ORA-00001: unique constraint (AN_FIELD.CODE) violated...<BR /> ... ORA-06512: at "AN_FIELD.DATA_TRANSFER", line 5523...</P> <P>I would like to extract "ORA-00001: unique constraint (AN_FIELD.CODE) violated" and "FIELD" separately.</P> <P>How can I do this?</P> Tue, 29 Sep 2020 10:55:30 GMT https://community.splunk.com/t5/Splunk-Search/Extract-fields-using-regex/m-p/273092#M176773 siddharthmis 2020-09-29T10:55:30Z https://community.splunk.com/t5/Splunk-Search/Extract-fields-using-regex/m-p/273093#M176774 <P>See if this works</P> <PRE><CODE>... | rex "(?&lt;msg&gt;ORA.*\(AN\_(?&lt;field&gt;\w+).*)" | table msg field </CODE></PRE> Fri, 09 Sep 2016 13:04:31 GMT https://community.splunk.com/t5/Splunk-Search/Extract-fields-using-regex/m-p/273093#M176774 sundareshr 2016-09-09T13:04:31Z https://community.splunk.com/t5/Splunk-Search/Extract-fields-using-regex/m-p/273094#M176775 <P>Try this</P> <PRE><CODE>(?&lt;msg&gt;ORA-00001:.*?_(?&lt;field&gt;[^\.]+)\..*violated) </CODE></PRE> Fri, 09 Sep 2016 13:05:30 GMT https://community.splunk.com/t5/Splunk-Search/Extract-fields-using-regex/m-p/273094#M176775 richgalloway 2016-09-09T13:05:30Z https://community.splunk.com/t5/Splunk-Search/Extract-fields-using-regex/m-p/273095#M176776 <P>Both seems to work, Thanks for the super fast response.</P> Fri, 09 Sep 2016 13:40:44 GMT https://community.splunk.com/t5/Splunk-Search/Extract-fields-using-regex/m-p/273095#M176776 siddharthmis 2016-09-09T13:40:44Z