https://community.splunk.com/t5/Splunk-Search/Extract-Part-of-Field/m-p/328087#M97643 <P>hi,<BR /> Can you please try (assuming second block in your data is what you want)</P> <PRE><CODE>|makeresults | eval myString="/country-private/file-upload-ready/1d555d59-9b5f-4877-bc76-2597142e1964/9011be92-6a1b-46a6-9e56-48dfdbf36c24"| rex field=myString "\/.+?\/(?&lt;fileStatus&gt;.+?)\/" </CODE></PRE> <P><A href="https://regex101.com/r/CvfqNH/1">https://regex101.com/r/CvfqNH/1</A></P> Fri, 27 Oct 2017 11:55:15 GMT koshyk 2017-10-27T11:55:15Z https://community.splunk.com/t5/Splunk-Search/Extract-Part-of-Field/m-p/328084#M97640 <P>Hi, I wonder whether someone could help me please.</P> <P>I'm trying to extract a particular value from a field which is "file-upload-ready". I can manage to exclude the value but not to extract it.</P> <P>This is and example of the data string:</P> <PRE><CODE>/country-private/file-upload-ready/1d555d59-9b5f-4877-bc76-2597142e1964/9011be92-6a1b-46a6-9e56-48dfdbf36c24 </CODE></PRE> <P>Many thanks and kind regards</P> <P>Chris</P> Fri, 27 Oct 2017 09:09:39 GMT https://community.splunk.com/t5/Splunk-Search/Extract-Part-of-Field/m-p/328084#M97640 IRHM73 2017-10-27T09:09:39Z https://community.splunk.com/t5/Splunk-Search/Extract-Part-of-Field/m-p/328085#M97641 <P>you can do it by using rex command, </P> <P>search .... | rex field=your_field "\/(?\w+-\w+)\/"</P> <P>just verify the reg ex once.</P> Fri, 27 Oct 2017 09:29:25 GMT https://community.splunk.com/t5/Splunk-Search/Extract-Part-of-Field/m-p/328085#M97641 kunalmao 2017-10-27T09:29:25Z https://community.splunk.com/t5/Splunk-Search/Extract-Part-of-Field/m-p/328086#M97642 <P>Hi @kunalmaom thank you for this, but unfortunately this doesn't extract any data.</P> <P>Many thanks and kind regards</P> <P>Chris</P> Fri, 27 Oct 2017 09:43:48 GMT https://community.splunk.com/t5/Splunk-Search/Extract-Part-of-Field/m-p/328086#M97642 IRHM73 2017-10-27T09:43:48Z https://community.splunk.com/t5/Splunk-Search/Extract-Part-of-Field/m-p/328087#M97643 <P>hi,<BR /> Can you please try (assuming second block in your data is what you want)</P> <PRE><CODE>|makeresults | eval myString="/country-private/file-upload-ready/1d555d59-9b5f-4877-bc76-2597142e1964/9011be92-6a1b-46a6-9e56-48dfdbf36c24"| rex field=myString "\/.+?\/(?&lt;fileStatus&gt;.+?)\/" </CODE></PRE> <P><A href="https://regex101.com/r/CvfqNH/1">https://regex101.com/r/CvfqNH/1</A></P> Fri, 27 Oct 2017 11:55:15 GMT https://community.splunk.com/t5/Splunk-Search/Extract-Part-of-Field/m-p/328087#M97643 koshyk 2017-10-27T11:55:15Z https://community.splunk.com/t5/Splunk-Search/Extract-Part-of-Field/m-p/328088#M97644 <P>Many thanks @koshyk.</P> <P>Regards</P> <P>Chris</P> Fri, 27 Oct 2017 12:11:04 GMT https://community.splunk.com/t5/Splunk-Search/Extract-Part-of-Field/m-p/328088#M97644 IRHM73 2017-10-27T12:11:04Z https://community.splunk.com/t5/Splunk-Search/Extract-Part-of-Field/m-p/328089#M97645 <P>obviously it won't , the regex is not correct <span class="lia-unicode-emoji" title=":face_with_tongue:">😛</span></P> Fri, 27 Oct 2017 14:04:34 GMT https://community.splunk.com/t5/Splunk-Search/Extract-Part-of-Field/m-p/328089#M97645 kunalmao 2017-10-27T14:04:34Z