https://community.splunk.com/t5/Splunk-Search/how-to-write-the-regular-expression-for-my-statement/m-p/317549#M94981 <P>thank for the information adayton and i tried with above search and not receiving any value under the External.</P> Fri, 24 Feb 2017 12:40:37 GMT lksridhar 2017-02-24T12:40:37Z https://community.splunk.com/t5/Splunk-Search/how-to-write-the-regular-expression-for-my-statement/m-p/317547#M94979 <P>Hi folks,</P> <P>could you please anyone help me to write the regex for below statement and need extract the external value from below logs.</P> <P>EXTERNAL:10.23.9.121/587327</P> Fri, 24 Feb 2017 11:19:56 GMT https://community.splunk.com/t5/Splunk-Search/how-to-write-the-regular-expression-for-my-statement/m-p/317547#M94979 lksridhar 2017-02-24T11:19:56Z https://community.splunk.com/t5/Splunk-Search/how-to-write-the-regular-expression-for-my-statement/m-p/317548#M94980 <P>Give this a try:</P> <PRE><CODE>|rex field=_raw "EXTERNAL\:(?P&lt;EXTERNAL&gt;.[^\s]*)" </CODE></PRE> Fri, 24 Feb 2017 12:18:31 GMT https://community.splunk.com/t5/Splunk-Search/how-to-write-the-regular-expression-for-my-statement/m-p/317548#M94980 adayton20 2017-02-24T12:18:31Z https://community.splunk.com/t5/Splunk-Search/how-to-write-the-regular-expression-for-my-statement/m-p/317549#M94981 <P>thank for the information adayton and i tried with above search and not receiving any value under the External.</P> Fri, 24 Feb 2017 12:40:37 GMT https://community.splunk.com/t5/Splunk-Search/how-to-write-the-regular-expression-for-my-statement/m-p/317549#M94981 lksridhar 2017-02-24T12:40:37Z https://community.splunk.com/t5/Splunk-Search/how-to-write-the-regular-expression-for-my-statement/m-p/317550#M94982 <P>Can you provide a sample of the raw log, please?</P> Fri, 24 Feb 2017 12:53:12 GMT https://community.splunk.com/t5/Splunk-Search/how-to-write-the-regular-expression-for-my-statement/m-p/317550#M94982 adayton20 2017-02-24T12:53:12Z https://community.splunk.com/t5/Splunk-Search/how-to-write-the-regular-expression-for-my-statement/m-p/317551#M94983 <P>Try</P> <PRE><CODE>... my search here | rex field=_raw "EXTERNAL:(?&lt;EXTERNAL&gt;\d+\.\d+\.\d+\.\d+\/\d+)" </CODE></PRE> <P>You can see it works in this example at <A href="https://regex101.com/r/hMtFCm/1">regex101.com</A>.</P> Fri, 24 Feb 2017 13:06:00 GMT https://community.splunk.com/t5/Splunk-Search/how-to-write-the-regular-expression-for-my-statement/m-p/317551#M94983 Richfez 2017-02-24T13:06:00Z https://community.splunk.com/t5/Splunk-Search/how-to-write-the-regular-expression-for-my-statement/m-p/317552#M94984 <P>AFAIK shouldn't have to use a backward slash on colons. </P> Fri, 24 Feb 2017 16:36:58 GMT https://community.splunk.com/t5/Splunk-Search/how-to-write-the-regular-expression-for-my-statement/m-p/317552#M94984 zanb 2017-02-24T16:36:58Z https://community.splunk.com/t5/Splunk-Search/how-to-write-the-regular-expression-for-my-statement/m-p/317553#M94985 <P>adayton and zanb , the below command is working fine.</P> <P>rex field=_raw "EXTERNAL:(?P.[^\s]*)"</P> Mon, 27 Feb 2017 11:05:33 GMT https://community.splunk.com/t5/Splunk-Search/how-to-write-the-regular-expression-for-my-statement/m-p/317553#M94985 lksridhar 2017-02-27T11:05:33Z