https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-string-with-regex/m-p/580739#M202309 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/87518">@FrankVl</a>&nbsp;How to extract from and To fields For this below Line using Regex</P><P>Info: Bounced: DCID 8413617 MID 19338947 From: &lt;MariaDubois@example.com&gt; To: &lt;zecora@buttercupgames.com&gt; RID 0 - 5.4.7 - Delivery expired (message too old) ('000', ['timeout'])</P><P>Please help me with the Solution ,Thanks&nbsp;</P> Wed, 12 Jan 2022 08:53:27 GMT Kumar2 2022-01-12T08:53:27Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-string-with-regex/m-p/392796#M114268 <P>Hello!</P> <P>I'm having trouble extracting the string "RES ONE Workspace Agent". Can anyone please tell me where I'm going wrong? </P> <PRE><CODE>rex field=pluginText "(?P(^RES ONE Workspace Agent$))" </CODE></PRE> <P>[installed on 2017/11/09]\nRES ONE Workspace Agent [version 10.1.200.0]</P> <P>Much appreciated!</P> Fri, 15 Jun 2018 03:51:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-string-with-regex/m-p/392796#M114268 dgillette3 2018-06-15T03:51:26Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-string-with-regex/m-p/392797#M114269 <P><STRONG>Can you please use the code button (101010) to post any search queries and sample data? Looks like some special characters may have gotten lost!</STRONG></P> <P><CODE>^</CODE> and <CODE>$</CODE> match start and end of the line. Since the string you want to extract is in the middle of the data, that doesn't work (assuming the sample you shared is the content of the pluginText field on which you apply the regex).</P> <P>Probably this would work:</P> <PRE><CODE>| rex field=pluginText "(?&lt;fieldname&gt;RES ONE Workspace Agent)" </CODE></PRE> <P>Just out of curiosity: what is your purpose with extracting a literal string like that? Couldn't you just as well do: <CODE>| eval field = "RES ONE Workspace Agent"</CODE>?</P> Fri, 15 Jun 2018 07:43:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-string-with-regex/m-p/392797#M114269 FrankVl 2018-06-15T07:43:40Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-string-with-regex/m-p/392798#M114270 <P>Thank you Frank, worked like a charm. </P> Fri, 15 Jun 2018 14:47:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-string-with-regex/m-p/392798#M114270 dgillette3 2018-06-15T14:47:52Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-string-with-regex/m-p/580739#M202309 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/87518">@FrankVl</a>&nbsp;How to extract from and To fields For this below Line using Regex</P><P>Info: Bounced: DCID 8413617 MID 19338947 From: &lt;MariaDubois@example.com&gt; To: &lt;zecora@buttercupgames.com&gt; RID 0 - 5.4.7 - Delivery expired (message too old) ('000', ['timeout'])</P><P>Please help me with the Solution ,Thanks&nbsp;</P> Wed, 12 Jan 2022 08:53:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-string-with-regex/m-p/580739#M202309 Kumar2 2022-01-12T08:53:27Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-string-with-regex/m-p/580742#M202310 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/87518">@FrankVl</a>&nbsp;In this way&nbsp;</P><P>from_mail_id = MariaDubois@example.com<BR />to_mail_id = zecora@buttercupgames.com</P> Wed, 12 Jan 2022 08:55:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-string-with-regex/m-p/580742#M202310 Kumar2 2022-01-12T08:55:59Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-string-with-regex/m-p/580811#M202343 <P>Hello! You may have better luck with your question if you post individually instead of as a reply!&nbsp;<BR /><BR />If you need help with anything- please don't hesitate to reach out!&nbsp;</P> Wed, 12 Jan 2022 15:56:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-string-with-regex/m-p/580811#M202343 yeasuh 2022-01-12T15:56:50Z