topic Re: How to extract value with in brackets in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-extract-value-with-in-brackets/m-p/134802#M184709 <P>Hi kavyatim,</P> <P>something like</P> <PRE><CODE>YourFancySearch | rex "\((?&lt;myField&gt;.*)\)" </CODE></PRE> <P>should work fine for you.<BR /> Here is a <A href="http://www.regexr.com/">link</A> to a page were you can test regex on your data.</P> <P>hope this helps ...</P> <P>cheers, MuS</P> Mon, 03 Feb 2014 12:17:18 GMT MuS 2014-02-03T12:17:18Z How to extract value with in brackets https://community.splunk.com/t5/Splunk-Search/How-to-extract-value-with-in-brackets/m-p/134801#M184708 <P>Hi ,<BR /> I have data in the following format:<BR /> NOT_HOMOLOGATED-(UNKNOWN)<BR /> HOMOLOGATED-(Thomson SpeedTouch ST510 V6 versao 6.2.15.7 or ST585 v6)<BR /> NOT_HOMOLOGATED-(UNKNOWN)<BR /> HOMOLOGATED-(ZTE ZXDSL 831 II V7.5.02_E09_BR1)<BR /> NOT_HOMOLOGATED-(UNKNOWN)<BR /> NOT_HOMOLOGATED-(UNKNOWN)<BR /> HOMOLOGATED-(ZTE ZXDSL 831 II V7.5.02_E09_BR1)<BR /> HOMOLOGATED-(Thomson SpeedTouch ST510 V6 versao 6.2.15.7 or ST585 v6)<BR /> I would like to extract value with in the brackets i.e extracted values should be:<BR /> UNKNOWN<BR /> Thomson SpeedTouch ST510 V6 versao 6.2.15.7 or ST585 v6<BR /> UNKNOWN<BR /> ZTE ZXDSL 831 II V7.5.02_E09_BR1 <BR /> and so on . . . . . </P> <P>Can any one help me out in writing regex for this as it is not flexible with substring?</P> <P>Thanking you in advance.</P> Mon, 28 Sep 2020 15:47:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-value-with-in-brackets/m-p/134801#M184708 kavyatim 2020-09-28T15:47:36Z Re: How to extract value with in brackets https://community.splunk.com/t5/Splunk-Search/How-to-extract-value-with-in-brackets/m-p/134802#M184709 <P>Hi kavyatim,</P> <P>something like</P> <PRE><CODE>YourFancySearch | rex "\((?&lt;myField&gt;.*)\)" </CODE></PRE> <P>should work fine for you.<BR /> Here is a <A href="http://www.regexr.com/">link</A> to a page were you can test regex on your data.</P> <P>hope this helps ...</P> <P>cheers, MuS</P> Mon, 03 Feb 2014 12:17:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-value-with-in-brackets/m-p/134802#M184709 MuS 2014-02-03T12:17:18Z