topic Re: How do I extract the entire value for a field in my sample data? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-entire-value-for-a-field-in-my-sample-data/m-p/212796#M62366 <P>If the one @masonmorales gave isn't sufficient already Or perhaps to get the <CODE>comma</CODE> as well in the capture try below <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <PRE><CODE>your query to return events | rex "StatusMsg=(?&lt;statusMsg&gt;.*?)CrlMsg=" | table statusMsg </CODE></PRE> Wed, 04 Jan 2017 04:38:49 GMT gokadroid 2017-01-04T04:38:49Z How do I extract the entire value for a field in my sample data? https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-entire-value-for-a-field-in-my-sample-data/m-p/212794#M62364 <P>I'd like to get contents between fields. Here is a sample log.</P> <PRE><CODE>CheckPointCount=N/A,CheckPointRestart=no,CheckPointInterval=5,StatusMsg=Open file "d:\data\Inbound Files\ABCSystems\DIFF.PRN" failed. ,CrlMsg=N/A,StatusDiagCode=08,StatusSeverity=01, </CODE></PRE> <P>When I use "StatusMsg" in query, only "Open" is selected. I'd like to retrieve all content before "CrlMsg".<BR /> How can I retrieve entire StatusMsg?</P> Tue, 03 Jan 2017 21:01:38 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-entire-value-for-a-field-in-my-sample-data/m-p/212794#M62364 ynegoro 2017-01-03T21:01:38Z Re: How do I extract the entire value for a field in my sample data? https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-entire-value-for-a-field-in-my-sample-data/m-p/212795#M62365 <PRE><CODE>| rex "StatusMsg=(?&lt;StatusMsg&gt;[^,]+),CrlMsg" </CODE></PRE> Tue, 03 Jan 2017 21:08:54 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-entire-value-for-a-field-in-my-sample-data/m-p/212795#M62365 masonmorales 2017-01-03T21:08:54Z Re: How do I extract the entire value for a field in my sample data? https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-entire-value-for-a-field-in-my-sample-data/m-p/212796#M62366 <P>If the one @masonmorales gave isn't sufficient already Or perhaps to get the <CODE>comma</CODE> as well in the capture try below <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <PRE><CODE>your query to return events | rex "StatusMsg=(?&lt;statusMsg&gt;.*?)CrlMsg=" | table statusMsg </CODE></PRE> Wed, 04 Jan 2017 04:38:49 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-entire-value-for-a-field-in-my-sample-data/m-p/212796#M62366 gokadroid 2017-01-04T04:38:49Z