topic Re: How to extract the field using Regex? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-field-using-Regex/m-p/301285#M90721 <P>Assuming the field is called guid:</P> <P>| rex field=guid "^ComputerName-.[^-]+-(?P[^\$]+)"</P> Thu, 16 Feb 2017 00:32:54 GMT starcher 2017-02-16T00:32:54Z How to extract the field using Regex? https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-field-using-Regex/m-p/301284#M90720 <P>HI,</P> <P>How to extract the field "AppGUID-{9BE518E6-ECC6-35A9-88E4-87755C07200F}" from the below field</P> <P>ComputerName-DJ001DJKWN03-AppGUID-{9BE518E6-ECC6-35A9-88E4-87755C07200F}</P> Thu, 16 Feb 2017 00:25:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-field-using-Regex/m-p/301284#M90720 kiran331 2017-02-16T00:25:11Z Re: How to extract the field using Regex? https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-field-using-Regex/m-p/301285#M90721 <P>Assuming the field is called guid:</P> <P>| rex field=guid "^ComputerName-.[^-]+-(?P[^\$]+)"</P> Thu, 16 Feb 2017 00:32:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-field-using-Regex/m-p/301285#M90721 starcher 2017-02-16T00:32:54Z Re: How to extract the field using Regex? https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-field-using-Regex/m-p/301286#M90722 <P>try like this:</P> <P>|stats c|eval _raw="ComputerName-DJ001DJKWN03-AppGUID-{9BE518E6-ECC6-35A9-88E4-87755C07200F}"|rex field=_raw "AppGUID..(?\w{8}-\w{4}-\w{4}-\w{4}-\w{12})"</P> Tue, 29 Sep 2020 12:52:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-field-using-Regex/m-p/301286#M90722 mpreddy 2020-09-29T12:52:32Z Re: How to extract the field using Regex? https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-field-using-Regex/m-p/301287#M90723 <P>As asked:</P> <PRE><CODE>(AppGUID-\{[^\}]+\}) </CODE></PRE> <P>As I suspect desired:</P> <PRE><CODE>AppGUID-(?&lt;AppGUID&gt;\{[^\}]+\}) </CODE></PRE> Sun, 19 Feb 2017 01:56:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-field-using-Regex/m-p/301287#M90723 woodcock 2017-02-19T01:56:54Z Re: How to extract the field using Regex? https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-field-using-Regex/m-p/301288#M90724 <P>@kiran331 - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post and upvote anything that was helpful. If no, please leave a comment with more feedback. Thanks.</P> Mon, 20 Mar 2017 02:31:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-field-using-Regex/m-p/301288#M90724 aaraneta_splunk 2017-03-20T02:31:06Z