topic Re: How do I extract a string from my sample log using the rex command? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-a-string-from-my-sample-log-using-the-rex/m-p/193163#M55568 <P>This works on regex101.com:</P> <PRE><CODE>... | rex "(?s)MSG:(?P&lt;string&gt;.*):EL" | ... </CODE></PRE> Mon, 06 Jul 2015 11:50:18 GMT richgalloway 2015-07-06T11:50:18Z How do I extract a string from my sample log using the rex command? https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-a-string-from-my-sample-log-using-the-rex/m-p/193162#M55567 <P>How do I extract the string from <CODE>MSG:</CODE> till <CODE>EL</CODE> from the sample log below using the rex command?</P> <PRE><CODE>BL: | LL: ERROR | TS: 2015-06-05 13:42:28,544 | AR: RxC_15.01.24.01 | STORE: 09560:wks02 | USER: 0589263 | HOST: wks02 | APPSERVER: rri1rxappa60/10.92.227.28 | MSGID: 09560-wks02-SCRRXDE01NewPrescriptionP-1433526148422: |SC: [com.cvs.rxconnect.web.RxConnectWebEntry.doPost] | MSG: EXCP Error completing service call com.cvs.rxconnect.rx.service.RxFillService.saveAIDetail | java.lang.NullPointerException at com.cvs.rxconnect.modeleValue194) at com.cvs.rxconnect.ai.boundary.(RxpAdditionalInfoBoundaryImpl.java:331) at com.cvs.rxconnect.ai.persistor.(istorImpl.java:9626) at com.cvs.rxconnect.ai.service.(AdditionalInfoServiceImpl.java:998) at com.cvs.rxconnect.rx.service.R(FillServiceImpl.java:11319) at com.cvs.rxconnect.rx.service.Re(&lt;generated&gt;) at net.sf.cglib.reflect.FastMethod.invoke(53) :EL </CODE></PRE> Mon, 06 Jul 2015 07:10:14 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-a-string-from-my-sample-log-using-the-rex/m-p/193162#M55567 kumina 2015-07-06T07:10:14Z Re: How do I extract a string from my sample log using the rex command? https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-a-string-from-my-sample-log-using-the-rex/m-p/193163#M55568 <P>This works on regex101.com:</P> <PRE><CODE>... | rex "(?s)MSG:(?P&lt;string&gt;.*):EL" | ... </CODE></PRE> Mon, 06 Jul 2015 11:50:18 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-a-string-from-my-sample-log-using-the-rex/m-p/193163#M55568 richgalloway 2015-07-06T11:50:18Z Re: How do I extract a string from my sample log using the rex command? https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-a-string-from-my-sample-log-using-the-rex/m-p/193164#M55569 <P>If this solved your problem, please accept the answer.</P> Fri, 10 Jul 2015 11:52:33 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-a-string-from-my-sample-log-using-the-rex/m-p/193164#M55569 richgalloway 2015-07-10T11:52:33Z