https://community.splunk.com/t5/Splunk-Search/How-to-extract-string-from-lookup-field/m-p/591746#M205979 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/192656">@nathanluke86</a>,</P><P>if you could share some sample of your data I could be more detailed, anyway, please try a regex like this:</P><LI-CODE lang="markup">| rex field=your_lookup_field "\&lt;query\&gt;(?&lt;eai:data&gt;[^\&lt;]*)"</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Thu, 31 Mar 2022 12:00:28 GMT gcusello 2022-03-31T12:00:28Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-string-from-lookup-field/m-p/591739#M205978 <P>Hi,</P> <P>&nbsp;</P> <P>I need to extract a string from a field in a lookup.</P> <P>need to extract between &lt;query&gt; and &lt;query&gt;&nbsp; and the field name is "eai:data"</P> <P>any help would be appreciated.</P> <P>&nbsp;</P> Thu, 31 Mar 2022 13:35:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-string-from-lookup-field/m-p/591739#M205978 nathanluke86 2022-03-31T13:35:09Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-string-from-lookup-field/m-p/591746#M205979 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/192656">@nathanluke86</a>,</P><P>if you could share some sample of your data I could be more detailed, anyway, please try a regex like this:</P><LI-CODE lang="markup">| rex field=your_lookup_field "\&lt;query\&gt;(?&lt;eai:data&gt;[^\&lt;]*)"</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Thu, 31 Mar 2022 12:00:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-string-from-lookup-field/m-p/591746#M205979 gcusello 2022-03-31T12:00:28Z