https://community.splunk.com/t5/Splunk-Search/how-to-extract-fields-using-regex/m-p/330142#M98270 <P>I have the below values in a field ,</P> <P>Sadf123.dfd.com<BR /> er-md-kt-mgmt.com<BR /> <A href="mailto:feb-fe345@tbm.com">feb-fe345@tbm.com</A></P> <P>I need to extract the values like below ,<BR /> Sadf123<BR /> er-md-kt<BR /> feb-fe345</P> <P>Can anyone help me to extract this </P> Fri, 13 Apr 2018 11:07:26 GMT umsundar2015 2018-04-13T11:07:26Z https://community.splunk.com/t5/Splunk-Search/how-to-extract-fields-using-regex/m-p/330142#M98270 <P>I have the below values in a field ,</P> <P>Sadf123.dfd.com<BR /> er-md-kt-mgmt.com<BR /> <A href="mailto:feb-fe345@tbm.com">feb-fe345@tbm.com</A></P> <P>I need to extract the values like below ,<BR /> Sadf123<BR /> er-md-kt<BR /> feb-fe345</P> <P>Can anyone help me to extract this </P> Fri, 13 Apr 2018 11:07:26 GMT https://community.splunk.com/t5/Splunk-Search/how-to-extract-fields-using-regex/m-p/330142#M98270 umsundar2015 2018-04-13T11:07:26Z https://community.splunk.com/t5/Splunk-Search/how-to-extract-fields-using-regex/m-p/330143#M98271 <P>Hi @umsundar2015,<BR /> Try This:</P> <PRE><CODE>...|rex "(?&lt;string&gt;\S+)[\.|\-|@]\w+\.com" </CODE></PRE> Fri, 13 Apr 2018 11:20:36 GMT https://community.splunk.com/t5/Splunk-Search/how-to-extract-fields-using-regex/m-p/330143#M98271 493669 2018-04-13T11:20:36Z https://community.splunk.com/t5/Splunk-Search/how-to-extract-fields-using-regex/m-p/330144#M98272 <P>thank you .</P> <P>String here means the field name rit ? </P> Fri, 13 Apr 2018 12:02:44 GMT https://community.splunk.com/t5/Splunk-Search/how-to-extract-fields-using-regex/m-p/330144#M98272 umsundar2015 2018-04-13T12:02:44Z https://community.splunk.com/t5/Splunk-Search/how-to-extract-fields-using-regex/m-p/330145#M98273 <P>This is not working , it displays values like <BR /> wkspfbtl18.devqa</P> <P>Can you please help with other regex</P> Fri, 13 Apr 2018 12:05:55 GMT https://community.splunk.com/t5/Splunk-Search/how-to-extract-fields-using-regex/m-p/330145#M98273 umsundar2015 2018-04-13T12:05:55Z https://community.splunk.com/t5/Splunk-Search/how-to-extract-fields-using-regex/m-p/330146#M98274 <P>string is the field name to be extracted...<BR /> here I assume that before your <CODE>.com</CODE> you need to extract till any special characters(like . or - or @) comes...<BR /> Please provide your raw data where it wont work<BR /> have a look at regex101 which is helpful site for trial <A href="https://regex101.com/r/088pwQ/1">https://regex101.com/r/088pwQ/1</A></P> Fri, 13 Apr 2018 13:09:26 GMT https://community.splunk.com/t5/Splunk-Search/how-to-extract-fields-using-regex/m-p/330146#M98274 493669 2018-04-13T13:09:26Z