https://community.splunk.com/t5/Splunk-Search/WIndows-Software-Installation-Extract-from-Message-Field/m-p/169935#M48596 <P>Try to create a field extraction for your source type and use the following expression:</P> <PRE><CODE>^Windows Installer.+\. Product Name: (?P&lt;productName&gt;.+)\. Product Version: (?P&lt;productVersion&gt;.+)\. Product Language: (?P&lt;productLanguage&gt;.+)\. Installation.+$ </CODE></PRE> <P>One thing I normally do, is to open the site <A href="http://regex101.com/">http://regex101.com/</A> and try the expression there. It's very helpful to understand what you're selecting.</P> Sun, 19 Oct 2014 22:32:03 GMT musskopf 2014-10-19T22:32:03Z https://community.splunk.com/t5/Splunk-Search/WIndows-Software-Installation-Extract-from-Message-Field/m-p/169934#M48595 <P>Hello, everone. I am new to regular and perl expressions and attempting to extract the Product Name, Product Version and Product Language from the following Message field:</P> <P>Windows Installer installed the product. Product Name: Java 7 Update 71. Product Version: 7.0.710. Product Language: 1033. Installation success or error status: 0.</P> <P>What would be the best way to extract so I can search by Product, Version or Language? Thanks.</P> Sun, 19 Oct 2014 18:33:10 GMT https://community.splunk.com/t5/Splunk-Search/WIndows-Software-Installation-Extract-from-Message-Field/m-p/169934#M48595 rmsit 2014-10-19T18:33:10Z https://community.splunk.com/t5/Splunk-Search/WIndows-Software-Installation-Extract-from-Message-Field/m-p/169935#M48596 <P>Try to create a field extraction for your source type and use the following expression:</P> <PRE><CODE>^Windows Installer.+\. Product Name: (?P&lt;productName&gt;.+)\. Product Version: (?P&lt;productVersion&gt;.+)\. Product Language: (?P&lt;productLanguage&gt;.+)\. Installation.+$ </CODE></PRE> <P>One thing I normally do, is to open the site <A href="http://regex101.com/">http://regex101.com/</A> and try the expression there. It's very helpful to understand what you're selecting.</P> Sun, 19 Oct 2014 22:32:03 GMT https://community.splunk.com/t5/Splunk-Search/WIndows-Software-Installation-Extract-from-Message-Field/m-p/169935#M48596 musskopf 2014-10-19T22:32:03Z https://community.splunk.com/t5/Splunk-Search/WIndows-Software-Installation-Extract-from-Message-Field/m-p/169936#M48597 <P>Thank you! Greatly appreciated.</P> Mon, 20 Oct 2014 00:47:12 GMT https://community.splunk.com/t5/Splunk-Search/WIndows-Software-Installation-Extract-from-Message-Field/m-p/169936#M48597 rmsit 2014-10-20T00:47:12Z