https://community.splunk.com/t5/Splunk-Search/Extract-text-from-message-field/m-p/668642#M229352 <P><SPAN>I need to extract a string from a message body,&nbsp; and make a new field for it.&nbsp;&nbsp;<BR /><BR />&lt;Junk_Message&gt; #body | Thing1 | Stuff2&nbsp; | meh4 | so on 1 | extra stuff3 | Blah4 &lt;/Junk_Message&gt;<BR />I just need the text that start with&nbsp;#body and end with Blah4. To make things more fun everything after #body generates randomly.<BR /><BR /><BR /><BR /><BR /></SPAN></P> Tue, 14 Nov 2023 19:44:09 GMT codedtech 2023-11-14T19:44:09Z https://community.splunk.com/t5/Splunk-Search/Extract-text-from-message-field/m-p/668642#M229352 <P><SPAN>I need to extract a string from a message body,&nbsp; and make a new field for it.&nbsp;&nbsp;<BR /><BR />&lt;Junk_Message&gt; #body | Thing1 | Stuff2&nbsp; | meh4 | so on 1 | extra stuff3 | Blah4 &lt;/Junk_Message&gt;<BR />I just need the text that start with&nbsp;#body and end with Blah4. To make things more fun everything after #body generates randomly.<BR /><BR /><BR /><BR /><BR /></SPAN></P> Tue, 14 Nov 2023 19:44:09 GMT https://community.splunk.com/t5/Splunk-Search/Extract-text-from-message-field/m-p/668642#M229352 codedtech 2023-11-14T19:44:09Z https://community.splunk.com/t5/Splunk-Search/Extract-text-from-message-field/m-p/668643#M229353 <P>It would help to know what you've tried so far and how those attempts failed you.</P><P>One method that works well for me is the <FONT face="courier new,courier">rex</FONT> command.&nbsp; This regex matches everything after "Junk_Message&gt;" until the following "&lt;" and puts it into a field called Junk_Message.</P><LI-CODE lang="markup">| rex "Junk_Message&gt;(?&lt;Junk_Message&gt;[^\&lt;])"</LI-CODE><P>&nbsp;</P> Tue, 14 Nov 2023 19:49:42 GMT https://community.splunk.com/t5/Splunk-Search/Extract-text-from-message-field/m-p/668643#M229353 richgalloway 2023-11-14T19:49:42Z