https://community.splunk.com/t5/Splunk-Search/How-do-I-modify-this-regular-expression-syntax/m-p/222400#M65408 <P>Try using <CODE>...| rex \s(\d{2}\.\d\.\d)\s</CODE></P> Mon, 26 Sep 2016 17:31:37 GMT skoelpin 2016-09-26T17:31:37Z https://community.splunk.com/t5/Splunk-Search/How-do-I-modify-this-regular-expression-syntax/m-p/222399#M65407 <P>I have a field with value like this <CODE>(R14760) 16.5.2 - FRI, 27 MAY 2016 13:46:07 EDT</CODE></P> <P>I want to extract <CODE>16.5.2</CODE> into a different field</P> <P>I'm using <CODE>eval =</CODE><BR /> I'm seeing errors like <CODE>illformed expression</CODE>. Any Pointers??</P> <P>Is there something wrong with Syntax?</P> Mon, 26 Sep 2016 16:59:52 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-modify-this-regular-expression-syntax/m-p/222399#M65407 msachdeva3 2016-09-26T16:59:52Z https://community.splunk.com/t5/Splunk-Search/How-do-I-modify-this-regular-expression-syntax/m-p/222400#M65408 <P>Try using <CODE>...| rex \s(\d{2}\.\d\.\d)\s</CODE></P> Mon, 26 Sep 2016 17:31:37 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-modify-this-regular-expression-syntax/m-p/222400#M65408 skoelpin 2016-09-26T17:31:37Z