https://community.splunk.com/t5/Splunk-Search/How-to-extract-values-from-an-event/m-p/598792#M208504 <LI-CODE lang="markup">| rex "Account Name:\s*(?&lt;accountname&gt;\S*)" | rex "Logon Type:\s*(?&lt;logontype&gt;\S*)"</LI-CODE> Sun, 22 May 2022 15:13:42 GMT ITWhisperer 2022-05-22T15:13:42Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-values-from-an-event/m-p/598791#M208503 <P>Hi,</P><P>I am trying to create a table but how do I&nbsp; extract these information in my query? I tried double quote " " but it's just looking for exact word.&nbsp;</P><P>I want to list out like Subject: Account Name, then Logon Info</P><P>&nbsp;</P><LI-CODE lang="markup">Subject: Security ID: S-1 Account Name: - Account Domain: - Logon ID: 0x0 Logon Information: Logon Type: 3 Restricted Admin Mode: - Virtual Account: No Elevated Token: No</LI-CODE><P>&nbsp;</P><P>rmation: Logon Type: 3. I hope it makes sense. Thank you&nbsp;</P> Sun, 22 May 2022 16:02:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-values-from-an-event/m-p/598791#M208503 TB 2022-05-22T16:02:36Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-values-from-an-event/m-p/598792#M208504 <LI-CODE lang="markup">| rex "Account Name:\s*(?&lt;accountname&gt;\S*)" | rex "Logon Type:\s*(?&lt;logontype&gt;\S*)"</LI-CODE> Sun, 22 May 2022 15:13:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-values-from-an-event/m-p/598792#M208504 ITWhisperer 2022-05-22T15:13:42Z