https://community.splunk.com/t5/Splunk-Search/Regex-to-extract-status-number-alone-from-extracted-field/m-p/194457#M56041 <P>Hi,</P> <P>I have two below field[rstatus] values extracted from events</P> <P>response.status = 200<BR /> response.status = 404</P> <P>Can you share the regex to extract number[i.e 200 or 404 alone ] from above string.</P> Thu, 06 Nov 2014 09:45:09 GMT Bhuavana 2014-11-06T09:45:09Z https://community.splunk.com/t5/Splunk-Search/Regex-to-extract-status-number-alone-from-extracted-field/m-p/194457#M56041 <P>Hi,</P> <P>I have two below field[rstatus] values extracted from events</P> <P>response.status = 200<BR /> response.status = 404</P> <P>Can you share the regex to extract number[i.e 200 or 404 alone ] from above string.</P> Thu, 06 Nov 2014 09:45:09 GMT https://community.splunk.com/t5/Splunk-Search/Regex-to-extract-status-number-alone-from-extracted-field/m-p/194457#M56041 Bhuavana 2014-11-06T09:45:09Z https://community.splunk.com/t5/Splunk-Search/Regex-to-extract-status-number-alone-from-extracted-field/m-p/194458#M56042 <P>Hello </P> <P>try this regex:</P> <PRE><CODE>...| rex field="rstatus" "response\.status\s\=\s(?&lt;yourfield&gt;\d+)" | ... </CODE></PRE> <P>Regards</P> Thu, 06 Nov 2014 10:16:05 GMT https://community.splunk.com/t5/Splunk-Search/Regex-to-extract-status-number-alone-from-extracted-field/m-p/194458#M56042 gfuente 2014-11-06T10:16:05Z https://community.splunk.com/t5/Splunk-Search/Regex-to-extract-status-number-alone-from-extracted-field/m-p/194459#M56043 <P>Thanks a lot.. above solution is worked...</P> Thu, 06 Nov 2014 10:29:33 GMT https://community.splunk.com/t5/Splunk-Search/Regex-to-extract-status-number-alone-from-extracted-field/m-p/194459#M56043 Bhuavana 2014-11-06T10:29:33Z