https://community.splunk.com/t5/Splunk-Search/rex-for-extract-codes/m-p/570951#M198960 <P>hi<BR />what is the rex for extract all brackets contain this pattern<BR />[AB_123] [ZXY_987]</P><P>1-check all brackets if start with AB_ extract this AB_123<BR />2-check all brackets if start with ZXY_ extract this ZXY_987<BR />3-put all this in single field that call "Codes"</P><P>any idea?<BR />thanks</P> Thu, 14 Oct 2021 11:40:08 GMT indeed_2000 2021-10-14T11:40:08Z https://community.splunk.com/t5/Splunk-Search/rex-for-extract-codes/m-p/570951#M198960 <P>hi<BR />what is the rex for extract all brackets contain this pattern<BR />[AB_123] [ZXY_987]</P><P>1-check all brackets if start with AB_ extract this AB_123<BR />2-check all brackets if start with ZXY_ extract this ZXY_987<BR />3-put all this in single field that call "Codes"</P><P>any idea?<BR />thanks</P> Thu, 14 Oct 2021 11:40:08 GMT https://community.splunk.com/t5/Splunk-Search/rex-for-extract-codes/m-p/570951#M198960 indeed_2000 2021-10-14T11:40:08Z https://community.splunk.com/t5/Splunk-Search/rex-for-extract-codes/m-p/570961#M198962 <LI-CODE lang="markup">| rex max_match=0 "\[(?&lt;Codes&gt;(AB|ZXY)[^\]]+)"</LI-CODE> Thu, 14 Oct 2021 12:21:42 GMT https://community.splunk.com/t5/Splunk-Search/rex-for-extract-codes/m-p/570961#M198962 ITWhisperer 2021-10-14T12:21:42Z