topic regular expression in Splunk Search https://community.splunk.com/t5/Splunk-Search/regular-expression/m-p/698043#M237090 <P>hello , i want to extract purple highlighted part.<BR /><BR /><FONT color="#CC99FF">[Time:29-08@17:53:03.562]</FONT> [60569219] 17:53:03.562 10.82.10.245 local3.notice [S=2952575] [SID=d57afa:30:1773441](N 71121555) #98)gwSession[Deallocated]<BR /><FONT color="#CC99FF">[Time:29-08@17:53:03.562]</FONT> [60569220]17:53:05.158 10.82.10.245 local3.notice [S=2952576] [SID=d57afa:30:1773434] (N 71121556) RtxMngr::Transmit 1 OPTIONS Rtx Left: 0 Dest: 211.237.70.18:5060, TU: AcSIPDialog(#28)(N 71121557) SIPTransaction(#471)::SendMsgBuffer - Resending last message<FONT color="#CC99FF">[Time:29-08@17:53:05.158]</FONT> [60569221] 17:53:05.654 10.82.10.245 local3.notice [S=2952577] [SID=d57afa:30:1773434] (N 71121558) RtxMngr::Dispatch - Retransmission of message 1 OPTIONS was ended. Terminating transaction... <FONT color="#CC99FF">[Time:29-08@17:53:05.654]</FONT> [60569222]17:53:05.654 10.82.10.245 local3.notice [S=2952578] [SID=d57afa:30:1773434] (N 71121559) AcSIPDialog(#28)::TransactionFail - ClientTransaction(#471) failed sending message with CSeq 1 OPTIONS CallID 20478380282982024175249@1.215.255.202, the cause is Transport Error [Time:29-08@17:53:05.654] [60569223]17:53:05.655 10.82.10.245 local0.warning [S=2952579] [BID=d57afa:30] RAISE-ALARM:acProxyConnectionLost: [KOREASBC1] Proxy Set Alarm Proxy Set 1 (PS_ITSP): Proxy lost. looking for another proxy; Severity:major; Source:Board#1/ProxyConnection#1; Unique ID:208; Additional Info1:; [Time:29-08@17:53:05.655] [60569224] 17:53:05.656 10.82.10.245 local0.warning [S=2952580] [BID=d57afa:30] RAISE-ALARM:acIpGroupNoRouteAlarm: [KOREASBC1] IP Group is temporarily blocked. IP Group (IPG_ITSP) Blocked Reason: No Working Proxy; Severity:major; Source:Board#1/IPGroup#2; Unique ID:209; Additional Info1:; [Time:29-08@17:53:05.656] [60569225]<BR />17:53:05.657 10.82.10.245</P> Tue, 03 Sep 2024 09:40:49 GMT Siddharthnegi 2024-09-03T09:40:49Z regular expression https://community.splunk.com/t5/Splunk-Search/regular-expression/m-p/698043#M237090 <P>hello , i want to extract purple highlighted part.<BR /><BR /><FONT color="#CC99FF">[Time:29-08@17:53:03.562]</FONT> [60569219] 17:53:03.562 10.82.10.245 local3.notice [S=2952575] [SID=d57afa:30:1773441](N 71121555) #98)gwSession[Deallocated]<BR /><FONT color="#CC99FF">[Time:29-08@17:53:03.562]</FONT> [60569220]17:53:05.158 10.82.10.245 local3.notice [S=2952576] [SID=d57afa:30:1773434] (N 71121556) RtxMngr::Transmit 1 OPTIONS Rtx Left: 0 Dest: 211.237.70.18:5060, TU: AcSIPDialog(#28)(N 71121557) SIPTransaction(#471)::SendMsgBuffer - Resending last message<FONT color="#CC99FF">[Time:29-08@17:53:05.158]</FONT> [60569221] 17:53:05.654 10.82.10.245 local3.notice [S=2952577] [SID=d57afa:30:1773434] (N 71121558) RtxMngr::Dispatch - Retransmission of message 1 OPTIONS was ended. Terminating transaction... <FONT color="#CC99FF">[Time:29-08@17:53:05.654]</FONT> [60569222]17:53:05.654 10.82.10.245 local3.notice [S=2952578] [SID=d57afa:30:1773434] (N 71121559) AcSIPDialog(#28)::TransactionFail - ClientTransaction(#471) failed sending message with CSeq 1 OPTIONS CallID 20478380282982024175249@1.215.255.202, the cause is Transport Error [Time:29-08@17:53:05.654] [60569223]17:53:05.655 10.82.10.245 local0.warning [S=2952579] [BID=d57afa:30] RAISE-ALARM:acProxyConnectionLost: [KOREASBC1] Proxy Set Alarm Proxy Set 1 (PS_ITSP): Proxy lost. looking for another proxy; Severity:major; Source:Board#1/ProxyConnection#1; Unique ID:208; Additional Info1:; [Time:29-08@17:53:05.655] [60569224] 17:53:05.656 10.82.10.245 local0.warning [S=2952580] [BID=d57afa:30] RAISE-ALARM:acIpGroupNoRouteAlarm: [KOREASBC1] IP Group is temporarily blocked. IP Group (IPG_ITSP) Blocked Reason: No Working Proxy; Severity:major; Source:Board#1/IPGroup#2; Unique ID:209; Additional Info1:; [Time:29-08@17:53:05.656] [60569225]<BR />17:53:05.657 10.82.10.245</P> Tue, 03 Sep 2024 09:40:49 GMT https://community.splunk.com/t5/Splunk-Search/regular-expression/m-p/698043#M237090 Siddharthnegi 2024-09-03T09:40:49Z Re: regular expression https://community.splunk.com/t5/Splunk-Search/regular-expression/m-p/698047#M237091 <LI-CODE lang="markup">| rex "(?&lt;time&gt;\[Time:[^\]]+\])"</LI-CODE> Tue, 03 Sep 2024 09:53:47 GMT https://community.splunk.com/t5/Splunk-Search/regular-expression/m-p/698047#M237091 ITWhisperer 2024-09-03T09:53:47Z Re: regular expression https://community.splunk.com/t5/Splunk-Search/regular-expression/m-p/743527#M241103 <P>below can extract:&nbsp;</P><P>"(?&lt;time&gt;Time:\d+\-\d+\@\d+:\d+:\d+\.\d{1,3})"</P> Fri, 04 Apr 2025 13:28:29 GMT https://community.splunk.com/t5/Splunk-Search/regular-expression/m-p/743527#M241103 okumar1 2025-04-04T13:28:29Z