https://community.splunk.com/t5/Splunk-Search/how-to-trim-the-values/m-p/90357#M23224 <P>i got right value</P> Tue, 13 Mar 2012 06:33:22 GMT john 2012-03-13T06:33:22Z https://community.splunk.com/t5/Splunk-Search/how-to-trim-the-values/m-p/90354#M23221 <P>id=[ci.fif.3000-67777]<BR /> id=[fg.hki.4000-88888]</P> <P>this the content of file i am working with from this i want only the values(3000 and 4000)please help.....</P> Tue, 13 Mar 2012 05:59:25 GMT https://community.splunk.com/t5/Splunk-Search/how-to-trim-the-values/m-p/90354#M23221 john 2012-03-13T05:59:25Z https://community.splunk.com/t5/Splunk-Search/how-to-trim-the-values/m-p/90355#M23222 <P>Extract the values as fields in Splunk. Quickest way is to use <CODE>rex</CODE>:</P> <PRE><CODE>... | rex "\.(?&lt;myvalue&gt;\d+)-\d+\]" </CODE></PRE> <P>This command creates a field <CODE>myfield</CODE> from your data when you include the command in your search.</P> Tue, 13 Mar 2012 06:19:47 GMT https://community.splunk.com/t5/Splunk-Search/how-to-trim-the-values/m-p/90355#M23222 Ayn 2012-03-13T06:19:47Z https://community.splunk.com/t5/Splunk-Search/how-to-trim-the-values/m-p/90356#M23223 <P>Thanks Ayn...</P> Tue, 13 Mar 2012 06:32:47 GMT https://community.splunk.com/t5/Splunk-Search/how-to-trim-the-values/m-p/90356#M23223 john 2012-03-13T06:32:47Z https://community.splunk.com/t5/Splunk-Search/how-to-trim-the-values/m-p/90357#M23224 <P>i got right value</P> Tue, 13 Mar 2012 06:33:22 GMT https://community.splunk.com/t5/Splunk-Search/how-to-trim-the-values/m-p/90357#M23224 john 2012-03-13T06:33:22Z