https://community.splunk.com/t5/Splunk-Search/How-to-extract-text-from-regular-expression-quot-StatusCode-10/m-p/164963#M46841 <P>Based on that one example, you could use this:</P> <PRE><CODE>\w+_\d+\.\d+\.\d+\.\d+_\d+_\d+_(&lt;field_name&gt;\d+) </CODE></PRE> Thu, 31 Jul 2014 08:36:51 GMT martin_mueller 2014-07-31T08:36:51Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-text-from-regular-expression-quot-StatusCode-10/m-p/164962#M46840 <P>Hi All,</P> <P>How to extract 10507178 from below string.here all are not constant.but format is same</P> <P>StatusCode_10.178.28.50_1406758126523_19607_10507178</P> Mon, 28 Sep 2020 17:13:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-text-from-regular-expression-quot-StatusCode-10/m-p/164962#M46840 mvaradarajam 2020-09-28T17:13:15Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-text-from-regular-expression-quot-StatusCode-10/m-p/164963#M46841 <P>Based on that one example, you could use this:</P> <PRE><CODE>\w+_\d+\.\d+\.\d+\.\d+_\d+_\d+_(&lt;field_name&gt;\d+) </CODE></PRE> Thu, 31 Jul 2014 08:36:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-text-from-regular-expression-quot-StatusCode-10/m-p/164963#M46841 martin_mueller 2014-07-31T08:36:51Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-text-from-regular-expression-quot-StatusCode-10/m-p/164964#M46842 <P>General one to get the last number in the string (after last underscore )</P> <PRE><CODE>"_(?&lt;YourField&gt;\d+)$" </CODE></PRE> Thu, 31 Jul 2014 13:17:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-text-from-regular-expression-quot-StatusCode-10/m-p/164964#M46842 somesoni2 2014-07-31T13:17:28Z