https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-this-string-between-the-3rd/m-p/205070#M59590 <P>the values at the end "1190FA52.log" is not constant (not always 13 at end)</P> Thu, 09 Jun 2016 07:45:32 GMT deenadp 2016-06-09T07:45:32Z https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-this-string-between-the-3rd/m-p/205069#M59589 <P>Hi,</P> <P>I would like to extract the strings between multiple delimiters as below.</P> <PRE><CODE>INPUT : src=`D:\GENEOS Program Files\App\FILE_DC_BP_JOBS_APACHE_DISPLAY_1190FA52.log` </CODE></PRE> <P>From the above I need to extract only <CODE>JOBS_APACHE_DISPLAY</CODE>. </P> <P>Can you please help? I have tried with multiple regex options, but it also fetches additional strings.</P> <P>Below is my attempt:</P> <PRE><CODE>| eval log=replace(src,"([^\\\]+\\\)","")| eval Name=substr(log,1,len(log)-13)| eval Name=substr(Name,12,len(log)) </CODE></PRE> <P>req: need to display the strings between 3rd and 6th <CODE>_</CODE> from </P> <PRE><CODE>&gt; FILE_DC_BP_JOBS_APACHE_DISPLAY_1190FA52.log </CODE></PRE> Thu, 09 Jun 2016 07:34:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-this-string-between-the-3rd/m-p/205069#M59589 deenadp 2016-06-09T07:34:42Z https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-this-string-between-the-3rd/m-p/205070#M59590 <P>the values at the end "1190FA52.log" is not constant (not always 13 at end)</P> Thu, 09 Jun 2016 07:45:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-this-string-between-the-3rd/m-p/205070#M59590 deenadp 2016-06-09T07:45:32Z https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-this-string-between-the-3rd/m-p/205071#M59591 <P>Try this</P> <PRE><CODE>.... | eval src=split(src, "_") | eval log=mvindex(src, 3)."_".mvindex(src, 4)."_".mvindex(src, 5) </CODE></PRE> Thu, 09 Jun 2016 11:16:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-this-string-between-the-3rd/m-p/205071#M59591 sundareshr 2016-06-09T11:16:08Z https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-this-string-between-the-3rd/m-p/205072#M59592 <P>Since your question mentioned regex, here's a solution using rex</P> <PRE><CODE>... | rex field=src "\w+_\w+_\w+_(?&lt;log&gt;\w+_\w+_\w+)_" | ... </CODE></PRE> Thu, 09 Jun 2016 12:33:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-this-string-between-the-3rd/m-p/205072#M59592 richgalloway 2016-06-09T12:33:45Z https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-this-string-between-the-3rd/m-p/205073#M59593 <P>This should work as well as better regex with lookahead lookbehind.</P> Thu, 09 Jun 2016 13:54:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-this-string-between-the-3rd/m-p/205073#M59593 axl88 2016-06-09T13:54:15Z https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-this-string-between-the-3rd/m-p/205074#M59594 <P>Like this:</P> <PRE><CODE>... | rex field=src "(?:[^_]+_){3}(?&lt;capture&gt;[^_]+_[^_]+_[^_]+)_" </CODE></PRE> Mon, 13 Jun 2016 17:34:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-this-string-between-the-3rd/m-p/205074#M59594 woodcock 2016-06-13T17:34:23Z