https://community.splunk.com/t5/Splunk-Search/How-to-extract-substring-from-a-string/m-p/590473#M205583 <P>Is this the exact string you have in your event? If so, try</P><LI-CODE lang="markup">| rex "iss = (?&lt;iss&gt;\S+)"</LI-CODE> Wed, 23 Mar 2022 15:43:28 GMT ITWhisperer 2022-03-23T15:43:28Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-substring-from-a-string/m-p/590469#M205580 <P>I have a string in this form:</P> <P><SPAN>sub = 13433</SPAN></P> <P><SPAN>cf-ipcountry = US </SPAN></P> <P>mail = <A href="mailto:steve.lin@cetera.com" target="_blank" rel="noopener">a</A>bc.test@gmail.com</P> <P>ct-remote-user = testaccount</P> <P>elevatedsession = N</P> <P>iss = <A href="http://www.google.com" target="_blank" rel="noopener">www.google.com</A></P> <P><SPAN>user-agent = Apache-HttpClient/4.5.8 (Java/1.8.0_322)</SPAN></P> <P>I want to extracr iss fields value</P> <P>I tried this but did not work</P> <P>| rex max_match=0 field=_raw "\/sub \/user-agent \/(?&lt;temp&gt;.*)"</P> Wed, 23 Mar 2022 22:07:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-substring-from-a-string/m-p/590469#M205580 abhipatthi 2022-03-23T22:07:50Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-substring-from-a-string/m-p/590473#M205583 <P>Is this the exact string you have in your event? If so, try</P><LI-CODE lang="markup">| rex "iss = (?&lt;iss&gt;\S+)"</LI-CODE> Wed, 23 Mar 2022 15:43:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-substring-from-a-string/m-p/590473#M205583 ITWhisperer 2022-03-23T15:43:28Z