https://community.splunk.com/t5/Splunk-Search/Get-a-value-from-Search/m-p/120279#M32302 <P>I have a search which is coming with this field-</P> <P>timezone=America/Montreal(EDT)offset-14400(Daylight).</P> <P>so how can i get only EDT? Any suggestion will be appreciated. </P> Fri, 04 Apr 2014 09:26:19 GMT abhi144 2014-04-04T09:26:19Z https://community.splunk.com/t5/Splunk-Search/Get-a-value-from-Search/m-p/120279#M32302 <P>I have a search which is coming with this field-</P> <P>timezone=America/Montreal(EDT)offset-14400(Daylight).</P> <P>so how can i get only EDT? Any suggestion will be appreciated. </P> Fri, 04 Apr 2014 09:26:19 GMT https://community.splunk.com/t5/Splunk-Search/Get-a-value-from-Search/m-p/120279#M32302 abhi144 2014-04-04T09:26:19Z https://community.splunk.com/t5/Splunk-Search/Get-a-value-from-Search/m-p/120280#M32303 <P>Hi,</P> <P>something like this should work:</P> <PRE><CODE>... | rex field="timezone" "\((?&lt;myTZ&gt;[A-Z]+)\)" | ... </CODE></PRE> <P>this will create a new field called <CODE>myTZ</CODE></P> <P>cheers, MuS</P> Fri, 04 Apr 2014 09:35:53 GMT https://community.splunk.com/t5/Splunk-Search/Get-a-value-from-Search/m-p/120280#M32303 MuS 2014-04-04T09:35:53Z