https://community.splunk.com/t5/Splunk-Search/Regex-for-string-between-to-delimeters/m-p/697737#M236995 <P>Hello,</P><P>Thank you for your help on this in advance,&nbsp; I just need to create a field in Splunk Search that contains the value between 2 delimiters.&nbsp; &nbsp; The delimiter is "?".&nbsp; For example.</P><P>Athena.siteone.com?suvathp001?443</P><P>What would be the regex to only extract suvathp001</P><P>Thanks again for your help,</P><P>Tom</P><P>&nbsp;</P><P>&nbsp;</P> Thu, 29 Aug 2024 16:57:37 GMT mninansplunk 2024-08-29T16:57:37Z https://community.splunk.com/t5/Splunk-Search/Regex-for-string-between-to-delimeters/m-p/697737#M236995 <P>Hello,</P><P>Thank you for your help on this in advance,&nbsp; I just need to create a field in Splunk Search that contains the value between 2 delimiters.&nbsp; &nbsp; The delimiter is "?".&nbsp; For example.</P><P>Athena.siteone.com?suvathp001?443</P><P>What would be the regex to only extract suvathp001</P><P>Thanks again for your help,</P><P>Tom</P><P>&nbsp;</P><P>&nbsp;</P> Thu, 29 Aug 2024 16:57:37 GMT https://community.splunk.com/t5/Splunk-Search/Regex-for-string-between-to-delimeters/m-p/697737#M236995 mninansplunk 2024-08-29T16:57:37Z https://community.splunk.com/t5/Splunk-Search/Regex-for-string-between-to-delimeters/m-p/697740#M236996 <P>The general form for that regex is "<FONT face="courier new,courier">&lt;&lt;delimiter&gt;&gt;(?&lt;field&gt;[^&lt;&lt;delimiter&gt;&gt;]+)</FONT>".&nbsp; In this case, the delimiter is a regex special character so escaping is needed.&nbsp; Try this command:</P><LI-CODE lang="markup">| rex "\?(?&lt;field&gt;[^\?]+)"</LI-CODE> Thu, 29 Aug 2024 17:45:56 GMT https://community.splunk.com/t5/Splunk-Search/Regex-for-string-between-to-delimeters/m-p/697740#M236996 richgalloway 2024-08-29T17:45:56Z