https://community.splunk.com/t5/Splunk-Search/Regex-Help/m-p/694021#M236077 <P>Like this?</P><P>&nbsp;</P><LI-CODE lang="markup">| rex "message: \((?&lt;in_parentheseses&gt;[^\)]+)"</LI-CODE><P>&nbsp;</P><P>You can test with</P><P>&nbsp;</P><LI-CODE lang="markup">| makeresults format=csv data="_raw message: (c4328dd3-d16e-4df8-a8e6-b2ebcab9d8bc)" ``` data emulation above ``` | rex "message: \((?&lt;in_parentheses&gt;[^\)]+)"</LI-CODE><P>&nbsp;</P><TABLE><TBODY><TR><TD>_raw</TD><TD>in_parentheses</TD></TR><TR><TD>message: (c4328dd3-d16e-4df8-a8e6-b2ebcab9d8bc)</TD><TD>c4328dd3-d16e-4df8-a8e6-b2ebcab9d8bc</TD></TR></TBODY></TABLE> Tue, 23 Jul 2024 04:23:21 GMT yuanliu 2024-07-23T04:23:21Z https://community.splunk.com/t5/Splunk-Search/Regex-Help/m-p/694017#M236076 <P>My Raw log says&nbsp;<SPAN>"</SPAN><SPAN class=""><SPAN class="">message</SPAN>:<SPAN>&nbsp;</SPAN><SPAN class="">(c4328dd3-d16e-4df8-a8e6-b2ebcab9d8bc)"&nbsp;</SPAN></SPAN></P><P><SPAN class=""><SPAN class="">I wanted to extract everything&nbsp; inside the&nbsp;&nbsp;<SPAN>Parentheses ( )</SPAN></SPAN></SPAN></P><P>&nbsp;</P><P><SPAN class=""><SPAN class=""><SPAN>Thanks in advance. </SPAN></SPAN></SPAN></P> Tue, 23 Jul 2024 02:58:12 GMT https://community.splunk.com/t5/Splunk-Search/Regex-Help/m-p/694017#M236076 kc_prane 2024-07-23T02:58:12Z https://community.splunk.com/t5/Splunk-Search/Regex-Help/m-p/694021#M236077 <P>Like this?</P><P>&nbsp;</P><LI-CODE lang="markup">| rex "message: \((?&lt;in_parentheseses&gt;[^\)]+)"</LI-CODE><P>&nbsp;</P><P>You can test with</P><P>&nbsp;</P><LI-CODE lang="markup">| makeresults format=csv data="_raw message: (c4328dd3-d16e-4df8-a8e6-b2ebcab9d8bc)" ``` data emulation above ``` | rex "message: \((?&lt;in_parentheses&gt;[^\)]+)"</LI-CODE><P>&nbsp;</P><TABLE><TBODY><TR><TD>_raw</TD><TD>in_parentheses</TD></TR><TR><TD>message: (c4328dd3-d16e-4df8-a8e6-b2ebcab9d8bc)</TD><TD>c4328dd3-d16e-4df8-a8e6-b2ebcab9d8bc</TD></TR></TBODY></TABLE> Tue, 23 Jul 2024 04:23:21 GMT https://community.splunk.com/t5/Splunk-Search/Regex-Help/m-p/694021#M236077 yuanliu 2024-07-23T04:23:21Z https://community.splunk.com/t5/Splunk-Search/Regex-Help/m-p/694567#M236234 <P>Thank you for the help&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/33901">@yuanliu</a>&nbsp;</P> Mon, 29 Jul 2024 15:49:06 GMT https://community.splunk.com/t5/Splunk-Search/Regex-Help/m-p/694567#M236234 kc_prane 2024-07-29T15:49:06Z