https://community.splunk.com/t5/Splunk-Search/Rex-formatting-trouble/m-p/569982#M198671 <P>Hi,</P><P>&nbsp;</P><P>Please, try the following:</P><LI-CODE lang="markup">| rex field=_raw "assessment=(?&lt;rating&gt;\S+)"</LI-CODE><P><BR /><BR /></P> Thu, 07 Oct 2021 05:45:01 GMT danielcj 2021-10-07T05:45:01Z https://community.splunk.com/t5/Splunk-Search/Rex-formatting-trouble/m-p/569964#M198666 <P>Hello again Spelunkers!&nbsp;<BR /><BR />So I have data that looks like this:<BR /><BR /></P><P>assessment=normal [1.0]<BR />assessment=normal [1.1]<BR />assessment=suspect [0.75]<BR />assessment=suspect [0.88]<BR />assessment=bad [0.467]</P><P><BR />I want a table column named rating that takes the "normal," "suspect," "bad" without the [###] after it. So I wrote the below thinking I can name the column rating and then capture any alpha characters and terminate at the white space between the word value and the [###] value. What would be the correct way of writing this? Thank you in advance!</P><P>&nbsp;</P><LI-CODE lang="markup">| rex field=raw_ "assessment=(?&lt;rating&gt;/\w/\s)"</LI-CODE><P>&nbsp;</P><P><BR /><BR /></P> Wed, 06 Oct 2021 22:53:19 GMT https://community.splunk.com/t5/Splunk-Search/Rex-formatting-trouble/m-p/569964#M198666 MikeB 2021-10-06T22:53:19Z https://community.splunk.com/t5/Splunk-Search/Rex-formatting-trouble/m-p/569982#M198671 <P>Hi,</P><P>&nbsp;</P><P>Please, try the following:</P><LI-CODE lang="markup">| rex field=_raw "assessment=(?&lt;rating&gt;\S+)"</LI-CODE><P><BR /><BR /></P> Thu, 07 Oct 2021 05:45:01 GMT https://community.splunk.com/t5/Splunk-Search/Rex-formatting-trouble/m-p/569982#M198671 danielcj 2021-10-07T05:45:01Z https://community.splunk.com/t5/Splunk-Search/Rex-formatting-trouble/m-p/570088#M198703 <P>Thank you! This worked perfectly.&nbsp;</P> Thu, 07 Oct 2021 16:36:17 GMT https://community.splunk.com/t5/Splunk-Search/Rex-formatting-trouble/m-p/570088#M198703 MikeB 2021-10-07T16:36:17Z