https://community.splunk.com/t5/Splunk-Search/Extract-string-using-rex/m-p/196401#M56671 <P>Finally got it right:</P> <P>rex field=_raw "] [(?<STEP>.+?)]"</STEP></P> Wed, 11 Jun 2014 19:56:06 GMT RVDowning 2014-06-11T19:56:06Z https://community.splunk.com/t5/Splunk-Search/Extract-string-using-rex/m-p/196399#M56669 <P>I have data that looks like:<BR /> 20140609 19:14:03 [PERF] [CREATE PLAN START] Action=CreatePlan,<BR /> and would like to extract the text between the second pair of brackets, namely in the above line the text "CREATE PLAN START."</P> <P>I tried rex field=_raw "]s+[=(?<STEP>[]])" but obviously this isn't right.</STEP></P> Wed, 11 Jun 2014 19:34:21 GMT https://community.splunk.com/t5/Splunk-Search/Extract-string-using-rex/m-p/196399#M56669 RVDowning 2014-06-11T19:34:21Z https://community.splunk.com/t5/Splunk-Search/Extract-string-using-rex/m-p/196400#M56670 <P>This looks like it might work for you:</P> <P><CODE>rex field=_raw "]\s+\[(?&lt;step&gt;[\w\s]*)\]"</CODE></P> Wed, 11 Jun 2014 19:46:45 GMT https://community.splunk.com/t5/Splunk-Search/Extract-string-using-rex/m-p/196400#M56670 aweitzman 2014-06-11T19:46:45Z https://community.splunk.com/t5/Splunk-Search/Extract-string-using-rex/m-p/196401#M56671 <P>Finally got it right:</P> <P>rex field=_raw "] [(?<STEP>.+?)]"</STEP></P> Wed, 11 Jun 2014 19:56:06 GMT https://community.splunk.com/t5/Splunk-Search/Extract-string-using-rex/m-p/196401#M56671 RVDowning 2014-06-11T19:56:06Z