https://community.splunk.com/t5/Splunk-Search/Help-with-regular-expression/m-p/278103#M83940 <P>Please try the following :</P> <PRE><CODE>| rex "cmdbRequest(?P&lt;Request_ID&gt;\d+)Transaction" | </CODE></PRE> Wed, 21 Oct 2015 08:35:22 GMT abhijitmishra87 2015-10-21T08:35:22Z https://community.splunk.com/t5/Splunk-Search/Help-with-regular-expression/m-p/278102#M83939 <P>I wish to extract any number between <STRONG>"cmdbRequest"</STRONG> &amp; <STRONG>"- Transaction"</STRONG> . For Example from below string </P> <BLOCKQUOTE> <P>ERROR 21 CMDB cmdbRequest <STRONG>1089798797</STRONG> - Transaction Null: 10/21/2015 07:25:34 - Exception: ORA-12578: TNS:wallet open failed</P> </BLOCKQUOTE> <P>i wish to extract <STRONG>1089798797</STRONG></P> <P>i have wrtten below regular expression to get the number, but its giving me a null value.</P> <P>| rex "CMDBRequest(?P&lt;Request_ID&gt;.*?)Transaction" |</P> <P>Can anyone please help ?</P> Wed, 21 Oct 2015 06:12:47 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-regular-expression/m-p/278102#M83939 indianhans 2015-10-21T06:12:47Z https://community.splunk.com/t5/Splunk-Search/Help-with-regular-expression/m-p/278103#M83940 <P>Please try the following :</P> <PRE><CODE>| rex "cmdbRequest(?P&lt;Request_ID&gt;\d+)Transaction" | </CODE></PRE> Wed, 21 Oct 2015 08:35:22 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-regular-expression/m-p/278103#M83940 abhijitmishra87 2015-10-21T08:35:22Z https://community.splunk.com/t5/Splunk-Search/Help-with-regular-expression/m-p/278104#M83941 <P>won't you need to cater for the stuff either side (spaces/dashes?</P> <PRE><CODE>rex "cmdbRequest\s(?&lt;Request_ID&gt;\d+)\s\-\sTransaction" </CODE></PRE> <P>...or something like that, depending on how consistent you expect it to all be. I've not tested it, but it might put you on the correct path</P> Wed, 21 Oct 2015 09:54:24 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-regular-expression/m-p/278104#M83941 bevant 2015-10-21T09:54:24Z