https://community.splunk.com/t5/Splunk-Search/How-to-make-a-field-extraction-for-my-sample-data/m-p/308963#M92664 <P>I want to make a field extraction by the name of Action to show this whole text ,'update ggsourceadmin.monitor set ORACLE_TIME = CURRENT_TIMESTAMP WHERE TABLE_PK = 1',; how should I extract? </P> Tue, 29 Sep 2020 14:11:04 GMT ewise1 2020-09-29T14:11:04Z https://community.splunk.com/t5/Splunk-Search/How-to-make-a-field-extraction-for-my-sample-data/m-p/308963#M92664 <P>I want to make a field extraction by the name of Action to show this whole text ,'update ggsourceadmin.monitor set ORACLE_TIME = CURRENT_TIMESTAMP WHERE TABLE_PK = 1',; how should I extract? </P> Tue, 29 Sep 2020 14:11:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-a-field-extraction-for-my-sample-data/m-p/308963#M92664 ewise1 2020-09-29T14:11:04Z https://community.splunk.com/t5/Splunk-Search/How-to-make-a-field-extraction-for-my-sample-data/m-p/308964#M92665 <P>You would have to show us the surrounding text, or examples of different versions, for us to know what to focus on in building the <CODE>regex</CODE>. </P> <P>One thing that I would check on is whether that whole SQL statement ended in a semicolon. If so, that makes it pretty easy to know when to stop. Assuming there is one, then this <CODE>rex</CODE> would do it.</P> <P>| rex "(i)(?update [^;]+;)" </P> Tue, 23 May 2017 19:52:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-a-field-extraction-for-my-sample-data/m-p/308964#M92665 DalJeanis 2017-05-23T19:52:55Z https://community.splunk.com/t5/Splunk-Search/How-to-make-a-field-extraction-for-my-sample-data/m-p/308965#M92666 <P>You need to show us the entire raw event.</P> Tue, 23 May 2017 21:48:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-a-field-extraction-for-my-sample-data/m-p/308965#M92666 woodcock 2017-05-23T21:48:05Z