https://community.splunk.com/t5/Splunk-Search/Separting-the-string-in-splunk/m-p/398436#M190842 <P>I have various search string under the field name entity:</P> <PRE><CODE> Entity </CODE></PRE> <P>1 GBP:BOOT2NDSUNQTR_MAINT4_lonlx11067<BR /> 2 GBP:BOOT2NDSUNMONTH_MAINT3_redlxd00130<BR /> 3 AMP:BOOT2NDSATMONTH_MAINT4_psclxd00034<BR /> 4 AMP:BOOTALLSUNMONTH_MAINT1_SecProd_DEV_totlxfidevsp126<BR /> .<BR /> .<BR /> .<BR /> and so on</P> <P>I want host name to be extracted such as lonlx11067,totlxfidevsp126 and do on. Could you help me in writing the query for the same I am particularly new to this</P> Wed, 30 Sep 2020 01:23:27 GMT mayank101 2020-09-30T01:23:27Z https://community.splunk.com/t5/Splunk-Search/Separting-the-string-in-splunk/m-p/398436#M190842 <P>I have various search string under the field name entity:</P> <PRE><CODE> Entity </CODE></PRE> <P>1 GBP:BOOT2NDSUNQTR_MAINT4_lonlx11067<BR /> 2 GBP:BOOT2NDSUNMONTH_MAINT3_redlxd00130<BR /> 3 AMP:BOOT2NDSATMONTH_MAINT4_psclxd00034<BR /> 4 AMP:BOOTALLSUNMONTH_MAINT1_SecProd_DEV_totlxfidevsp126<BR /> .<BR /> .<BR /> .<BR /> and so on</P> <P>I want host name to be extracted such as lonlx11067,totlxfidevsp126 and do on. Could you help me in writing the query for the same I am particularly new to this</P> Wed, 30 Sep 2020 01:23:27 GMT https://community.splunk.com/t5/Splunk-Search/Separting-the-string-in-splunk/m-p/398436#M190842 mayank101 2020-09-30T01:23:27Z https://community.splunk.com/t5/Splunk-Search/Separting-the-string-in-splunk/m-p/398437#M190843 <P>Write your extraction rex.</P> <PRE><CODE>... | rex field=Entity "_(?&lt;host&gt;[^_]+?)$" | table Entity host </CODE></PRE> Tue, 16 Jul 2019 19:34:51 GMT https://community.splunk.com/t5/Splunk-Search/Separting-the-string-in-splunk/m-p/398437#M190843 nick405060 2019-07-16T19:34:51Z https://community.splunk.com/t5/Splunk-Search/Separting-the-string-in-splunk/m-p/398438#M190844 <P>I did not understood what you said.What is extraction rex</P> Tue, 16 Jul 2019 19:40:36 GMT https://community.splunk.com/t5/Splunk-Search/Separting-the-string-in-splunk/m-p/398438#M190844 mayank101 2019-07-16T19:40:36Z https://community.splunk.com/t5/Splunk-Search/Separting-the-string-in-splunk/m-p/398439#M190845 <P><A href="https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/Rex">https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/Rex</A></P> Tue, 16 Jul 2019 19:42:32 GMT https://community.splunk.com/t5/Splunk-Search/Separting-the-string-in-splunk/m-p/398439#M190845 nick405060 2019-07-16T19:42:32Z