https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-value-between-to-identifiers/m-p/608539#M211598 <P>I'm looking for a way to extract a value from the middle of a sting. The value(green) I want is after the first underscore(blue) and before the dash(pink)</P> <P>Example:</P> <P>GET<FONT color="#0000FF">_</FONT><FONT color="#008000">tres_main.aspx_detail_showall</FONT><FONT color="#FF00FF">-</FONT>0</P> Fri, 05 Aug 2022 18:46:35 GMT wantjoule 2022-08-05T18:46:35Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-value-between-to-identifiers/m-p/608539#M211598 <P>I'm looking for a way to extract a value from the middle of a sting. The value(green) I want is after the first underscore(blue) and before the dash(pink)</P> <P>Example:</P> <P>GET<FONT color="#0000FF">_</FONT><FONT color="#008000">tres_main.aspx_detail_showall</FONT><FONT color="#FF00FF">-</FONT>0</P> Fri, 05 Aug 2022 18:46:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-value-between-to-identifiers/m-p/608539#M211598 wantjoule 2022-08-05T18:46:35Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-value-between-to-identifiers/m-p/608542#M211599 <P>With a limited example, this may not be enough</P><LI-CODE lang="markup">| rex "GET_(?&lt;value&gt;[^\-]+)"</LI-CODE> Fri, 05 Aug 2022 18:46:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-value-between-to-identifiers/m-p/608542#M211599 ITWhisperer 2022-08-05T18:46:25Z