https://community.splunk.com/t5/Splunk-Search/Help-with-Regex/m-p/216578#M63566 <P>Hi </P> <P>How can I extract the "TCP_MISS/200" and "TCP_MISS_SSL/200" or similar from the event below?</P> <P>1466609862.644 109 1.2.3.55 TCP_MISS/200 387 POST <A href="http://sdsd.com/put" target="_blank">http://sdsd.com/put</A> "<A href="mailto:user@dd.com" target="_blank">user@dd.com</A>" ...........</P> <P>1466609862.632 17096 2.3.4.167 TCP_MISS_SSL/200 1036 GET https://..................</P> Tue, 29 Sep 2020 09:59:32 GMT kiran331 2020-09-29T09:59:32Z https://community.splunk.com/t5/Splunk-Search/Help-with-Regex/m-p/216578#M63566 <P>Hi </P> <P>How can I extract the "TCP_MISS/200" and "TCP_MISS_SSL/200" or similar from the event below?</P> <P>1466609862.644 109 1.2.3.55 TCP_MISS/200 387 POST <A href="http://sdsd.com/put" target="_blank">http://sdsd.com/put</A> "<A href="mailto:user@dd.com" target="_blank">user@dd.com</A>" ...........</P> <P>1466609862.632 17096 2.3.4.167 TCP_MISS_SSL/200 1036 GET https://..................</P> Tue, 29 Sep 2020 09:59:32 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-Regex/m-p/216578#M63566 kiran331 2020-09-29T09:59:32Z https://community.splunk.com/t5/Splunk-Search/Help-with-Regex/m-p/216579#M63567 <P>Try</P> <PRE><CODE>... | rex "(?&lt;field&gt;TCP[^\s]+)" | ... </CODE></PRE> Wed, 22 Jun 2016 15:52:53 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-Regex/m-p/216579#M63567 richgalloway 2016-06-22T15:52:53Z