https://community.splunk.com/t5/Splunk-Search/Regex-expression-correction/m-p/86458#M22051 <P>I used (?i)location : (?P<CURRENT_LOCATION>.+) to extract the location. But it always extract the word below it (None). Anyone knows how to solve this ? I need to extract only Choa Chu Kang.</CURRENT_LOCATION></P> <P>My data is </P> <P>cloudCover : 0.75<BR /> dewPoint: 21.42<BR /> humidity: 54.00<BR /> icon : partly-cloudy-day<BR /> ozone : 274.19<BR /> precipIntensity : 0.003<BR /> precipProbability : 0.04<BR /> precipType : rain<BR /> pressure : 1007.45<BR /> summary : Mostly Cloudy<BR /> temperature: 31.68<BR /> visibility : 6.21<BR /> windBearing : 139<BR /> windSpeed : 11.9<BR /> psiAverage : 19<BR /> latitude : 1.394557<BR /> longitude : 103.746396<BR /> location : Choa Chu Kang<BR /> None</P> Sun, 07 Jul 2013 15:27:43 GMT kailun92 2013-07-07T15:27:43Z https://community.splunk.com/t5/Splunk-Search/Regex-expression-correction/m-p/86458#M22051 <P>I used (?i)location : (?P<CURRENT_LOCATION>.+) to extract the location. But it always extract the word below it (None). Anyone knows how to solve this ? I need to extract only Choa Chu Kang.</CURRENT_LOCATION></P> <P>My data is </P> <P>cloudCover : 0.75<BR /> dewPoint: 21.42<BR /> humidity: 54.00<BR /> icon : partly-cloudy-day<BR /> ozone : 274.19<BR /> precipIntensity : 0.003<BR /> precipProbability : 0.04<BR /> precipType : rain<BR /> pressure : 1007.45<BR /> summary : Mostly Cloudy<BR /> temperature: 31.68<BR /> visibility : 6.21<BR /> windBearing : 139<BR /> windSpeed : 11.9<BR /> psiAverage : 19<BR /> latitude : 1.394557<BR /> longitude : 103.746396<BR /> location : Choa Chu Kang<BR /> None</P> Sun, 07 Jul 2013 15:27:43 GMT https://community.splunk.com/t5/Splunk-Search/Regex-expression-correction/m-p/86458#M22051 kailun92 2013-07-07T15:27:43Z https://community.splunk.com/t5/Splunk-Search/Regex-expression-correction/m-p/86459#M22052 <P>You could try something like this which is a bit more explicit. </P> <PRE><CODE>(?im)^location\s:\s(?P&lt;current_location&gt;[^\n]+) </CODE></PRE> Sun, 07 Jul 2013 17:52:39 GMT https://community.splunk.com/t5/Splunk-Search/Regex-expression-correction/m-p/86459#M22052 okrabbe_splunk 2013-07-07T17:52:39Z https://community.splunk.com/t5/Splunk-Search/Regex-expression-correction/m-p/86460#M22053 <P>Thanks ! it works</P> Mon, 08 Jul 2013 00:48:26 GMT https://community.splunk.com/t5/Splunk-Search/Regex-expression-correction/m-p/86460#M22053 kailun92 2013-07-08T00:48:26Z