https://community.splunk.com/t5/Splunk-Search/Regex-for-getting-only-the-bold/m-p/638793#M221331 <LI-CODE lang="markup">| rex "\]:(?&lt;message&gt;.*)"</LI-CODE> Wed, 05 Apr 2023 08:55:13 GMT ITWhisperer 2023-04-05T08:55:13Z https://community.splunk.com/t5/Splunk-Search/Regex-for-getting-only-the-bold/m-p/638792#M221330 <P class="lia-align-left">I have field log-sshd like this:<BR /><BR />log-sshd="Apr 5 xx:xx:xx serverhost sshd[xxxx]: <STRONG>Failed password for user xxx from xx.xx.xxx.xx port xxxx ssh2</STRONG>"<BR /><BR />What is the SPL search if i just wanna get the word that i bolded ?</P> Wed, 05 Apr 2023 16:46:15 GMT https://community.splunk.com/t5/Splunk-Search/Regex-for-getting-only-the-bold/m-p/638792#M221330 f_666dhn 2023-04-05T16:46:15Z https://community.splunk.com/t5/Splunk-Search/Regex-for-getting-only-the-bold/m-p/638793#M221331 <LI-CODE lang="markup">| rex "\]:(?&lt;message&gt;.*)"</LI-CODE> Wed, 05 Apr 2023 08:55:13 GMT https://community.splunk.com/t5/Splunk-Search/Regex-for-getting-only-the-bold/m-p/638793#M221331 ITWhisperer 2023-04-05T08:55:13Z https://community.splunk.com/t5/Splunk-Search/Regex-for-getting-only-the-bold/m-p/638803#M221337 <P>Thanks</P> Wed, 05 Apr 2023 09:24:55 GMT https://community.splunk.com/t5/Splunk-Search/Regex-for-getting-only-the-bold/m-p/638803#M221337 f_666dhn 2023-04-05T09:24:55Z