https://community.splunk.com/t5/Splunk-Search/extract-selected-data-from-given-field/m-p/312959#M93673 <P>Try this</P> <PRE><CODE>yoursearchhere | rex field=original_field_name "(?&lt;error_code&gt;.*?)\s" </CODE></PRE> Thu, 06 Apr 2017 05:48:10 GMT lguinn2 2017-04-06T05:48:10Z https://community.splunk.com/t5/Splunk-Search/extract-selected-data-from-given-field/m-p/312958#M93672 <P>I've error messages in the filed name "ErrorMessage"; i want to extract only error code using regex expression.<BR /> Pls some one help with correct regex.</P> <P>filed1 field2 filed3 and so on ... ErrorMessage<BR /> ANK-BEQ-1014 Dispatcher detected an error4.<BR /> ANK-BEQ-1015 Dispatcher detected an error5.<BR /> ANK-BEQ-1016 Dispatcher detected an error6.<BR /> Logon Error.<BR /> System Error.</P> <P>Expected results Error codes:<BR /> ANK-BEQ-1014<BR /> ANK-BEQ-1015<BR /> ANK-BEQ-1016</P> Wed, 05 Apr 2017 19:50:39 GMT https://community.splunk.com/t5/Splunk-Search/extract-selected-data-from-given-field/m-p/312958#M93672 x05311 2017-04-05T19:50:39Z https://community.splunk.com/t5/Splunk-Search/extract-selected-data-from-given-field/m-p/312959#M93673 <P>Try this</P> <PRE><CODE>yoursearchhere | rex field=original_field_name "(?&lt;error_code&gt;.*?)\s" </CODE></PRE> Thu, 06 Apr 2017 05:48:10 GMT https://community.splunk.com/t5/Splunk-Search/extract-selected-data-from-given-field/m-p/312959#M93673 lguinn2 2017-04-06T05:48:10Z