https://community.splunk.com/t5/Splunk-Search/How-to-extract-language-field/m-p/131598#M35914 <P>Converted from <A href="http://answers.splunk.com/answers/193524/how-to-write-a-search-to-return-events-with-a-vari.html">http://answers.splunk.com/answers/193524/how-to-write-a-search-to-return-events-with-a-vari.html</A></P> <P>Hi,</P> <P>i want to extract this field language:</P> <P>language:ru-ru</P> <P>can you please help me what regular expression should i write?</P> <P>Thanks,<BR /> Snabel</P> Tue, 25 Nov 2014 15:01:05 GMT martin_mueller 2014-11-25T15:01:05Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-language-field/m-p/131598#M35914 <P>Converted from <A href="http://answers.splunk.com/answers/193524/how-to-write-a-search-to-return-events-with-a-vari.html">http://answers.splunk.com/answers/193524/how-to-write-a-search-to-return-events-with-a-vari.html</A></P> <P>Hi,</P> <P>i want to extract this field language:</P> <P>language:ru-ru</P> <P>can you please help me what regular expression should i write?</P> <P>Thanks,<BR /> Snabel</P> Tue, 25 Nov 2014 15:01:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-language-field/m-p/131598#M35914 martin_mueller 2014-11-25T15:01:05Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-language-field/m-p/131599#M35915 <P>Try this:</P> <PRE><CODE>language:(?&lt;language&gt;\w+-?\w*) </CODE></PRE> <P>In the long run you should consider setting up key-value extraction around the colon instead of the equals sign.</P> Tue, 25 Nov 2014 15:01:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-language-field/m-p/131599#M35915 martin_mueller 2014-11-25T15:01:40Z