https://community.splunk.com/t5/Splunk-Search/Regex-expression-Help-pls-urgent/m-p/72056#M18018 <P>I tried this but it still take out the value below it.</P> <P>time : 1371883969<BR /> visibility : 4.67<BR /> windBearing : 201<BR /> windSpeed : 11.6<BR /> psiAverage : 184<BR /> latitude : 1.429463<BR /> longitude : 103.835182<BR /> location : Yishun<BR /> cloudCover : 0.9<BR /> dewPoint : 63.11<BR /> humidity : 0.5<BR /> icon : wind<BR /> ozone : 273.95<BR /> precipIntensity : 0<BR /> pressure : 1006.59<BR /> summary : Breezy and Mostly Cloudy<BR /> temperature : 94.24</P> <P>Such as <BR /> cloudy<BR /> ozone : 273.95<BR /> precipIntensity : 0<BR /> pressure : 1006.59<BR /> summary : Breezy and Mostly Cloudy</P> <P>Any more ways that will work ?</P> Sat, 22 Jun 2013 06:59:11 GMT kailun92 2013-06-22T06:59:11Z https://community.splunk.com/t5/Splunk-Search/Regex-expression-Help-pls-urgent/m-p/72054#M18016 <P>I have these fields </P> <P>time : 1371877918<BR /> windBearing : 209<BR /> windSpeed : 6.34<BR /> psiAverage : 186<BR /> latitude : 1.429463<BR /> longitude : 103.835182<BR /> location : Yishun<BR /> cloudCover : 0.73<BR /> dewPoint : 69.96<BR /> humidity : 0.57<BR /> icon : partly-cloudy-day<BR /> ozone : 274.44<BR /> precipIntensity : 0<BR /> pressure : 1007.33<BR /> summary : Mostly Cloudy<BR /> temperature : 92.25</P> <P>Anyone could tell me how to extract icon using regex expression ? I used this (?i)icon : (?P<FIELDNAME>.+) expression but it return the bottom data also. Help pls. Thanks in advance.</FIELDNAME></P> Sat, 22 Jun 2013 05:22:24 GMT https://community.splunk.com/t5/Splunk-Search/Regex-expression-Help-pls-urgent/m-p/72054#M18016 kailun92 2013-06-22T05:22:24Z https://community.splunk.com/t5/Splunk-Search/Regex-expression-Help-pls-urgent/m-p/72055#M18017 <P>This should work:</P> <PRE><CODE>(?i)icon : (?P&lt;fieldname&gt;.+)\n </CODE></PRE> Sat, 22 Jun 2013 06:22:57 GMT https://community.splunk.com/t5/Splunk-Search/Regex-expression-Help-pls-urgent/m-p/72055#M18017 chris 2013-06-22T06:22:57Z https://community.splunk.com/t5/Splunk-Search/Regex-expression-Help-pls-urgent/m-p/72056#M18018 <P>I tried this but it still take out the value below it.</P> <P>time : 1371883969<BR /> visibility : 4.67<BR /> windBearing : 201<BR /> windSpeed : 11.6<BR /> psiAverage : 184<BR /> latitude : 1.429463<BR /> longitude : 103.835182<BR /> location : Yishun<BR /> cloudCover : 0.9<BR /> dewPoint : 63.11<BR /> humidity : 0.5<BR /> icon : wind<BR /> ozone : 273.95<BR /> precipIntensity : 0<BR /> pressure : 1006.59<BR /> summary : Breezy and Mostly Cloudy<BR /> temperature : 94.24</P> <P>Such as <BR /> cloudy<BR /> ozone : 273.95<BR /> precipIntensity : 0<BR /> pressure : 1006.59<BR /> summary : Breezy and Mostly Cloudy</P> <P>Any more ways that will work ?</P> Sat, 22 Jun 2013 06:59:11 GMT https://community.splunk.com/t5/Splunk-Search/Regex-expression-Help-pls-urgent/m-p/72056#M18018 kailun92 2013-06-22T06:59:11Z https://community.splunk.com/t5/Splunk-Search/Regex-expression-Help-pls-urgent/m-p/72057#M18019 <P>Try changing the <CODE>.+</CODE> to <CODE>[^\s\n]+</CODE></P> Sat, 22 Jun 2013 12:30:01 GMT https://community.splunk.com/t5/Splunk-Search/Regex-expression-Help-pls-urgent/m-p/72057#M18019 starcher 2013-06-22T12:30:01Z https://community.splunk.com/t5/Splunk-Search/Regex-expression-Help-pls-urgent/m-p/72058#M18020 <P>Thank you sooo much !!!!! love ya !</P> Sat, 22 Jun 2013 16:50:16 GMT https://community.splunk.com/t5/Splunk-Search/Regex-expression-Help-pls-urgent/m-p/72058#M18020 kailun92 2013-06-22T16:50:16Z https://community.splunk.com/t5/Splunk-Search/Regex-expression-Help-pls-urgent/m-p/72059#M18021 <P>Good job !</P> Sat, 22 Jun 2013 16:50:39 GMT https://community.splunk.com/t5/Splunk-Search/Regex-expression-Help-pls-urgent/m-p/72059#M18021 kailun92 2013-06-22T16:50:39Z