https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-rex-search-to-extract-field-values-with-a-hyphen/m-p/142420#M39536 <P>Hi</P> <P>I am extracting a field named <CODE>revision</CODE> from raw data and the only possible field values are 1 or 2 consecutive upper case letters or a hyphen e.g.(A,B,AC,GF, -). I tried the following, but it didn't extract the field values with a hyphen:</P> <PRE><CODE> | rex field=_raw " Revision (?[-A-Z]{1,2})" </CODE></PRE> Mon, 13 Apr 2015 17:16:10 GMT edrivera3 2015-04-13T17:16:10Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-rex-search-to-extract-field-values-with-a-hyphen/m-p/142420#M39536 <P>Hi</P> <P>I am extracting a field named <CODE>revision</CODE> from raw data and the only possible field values are 1 or 2 consecutive upper case letters or a hyphen e.g.(A,B,AC,GF, -). I tried the following, but it didn't extract the field values with a hyphen:</P> <PRE><CODE> | rex field=_raw " Revision (?[-A-Z]{1,2})" </CODE></PRE> Mon, 13 Apr 2015 17:16:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-rex-search-to-extract-field-values-with-a-hyphen/m-p/142420#M39536 edrivera3 2015-04-13T17:16:10Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-rex-search-to-extract-field-values-with-a-hyphen/m-p/142421#M39537 <P>For some reason, it doesn't appear the angle bracket with the word "revision".</P> Mon, 13 Apr 2015 17:19:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-rex-search-to-extract-field-values-with-a-hyphen/m-p/142421#M39537 edrivera3 2015-04-13T17:19:46Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-rex-search-to-extract-field-values-with-a-hyphen/m-p/142422#M39538 <P>Try this (assuming your data looks like this " some data Revision A" OR " some data Revision AB" OR " some data Revision -")</P> <PRE><CODE> your base search | rex " Revision\s+(?&lt;Revision&gt;[-A-Z]{1,2}) </CODE></PRE> Mon, 13 Apr 2015 17:47:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-rex-search-to-extract-field-values-with-a-hyphen/m-p/142422#M39538 somesoni2 2015-04-13T17:47:44Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-rex-search-to-extract-field-values-with-a-hyphen/m-p/142423#M39539 <P>That is what I did and it's correct. My error was that I didn't noticed that there is a space before the hyphen and the single upper case letter so I changed the regex and it worked. Thanks (I am going to accept your answer!)</P> <PRE><CODE>| rex " Revision (?[A-Z]{2,2}|\s\W|\s[A-Z])" </CODE></PRE> Mon, 13 Apr 2015 18:12:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-rex-search-to-extract-field-values-with-a-hyphen/m-p/142423#M39539 edrivera3 2015-04-13T18:12:23Z