topic How to use regex to extract field? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-extract-field/m-p/333890#M99275 <P>HI How to extract the field with space using regex?</P> <P>name:<BR /> T11345DDF ERROR<BR /> T11345SSDF Volume C</P> <P>values:<BR /> 123455-25335535-55454545-5656566-45655-36565656-6656-488656 TPM</P> <P>I need to extract T11345DDF , T11345SSDF , 123455-25335535-55454545-5656566-45655-36565656-6656-488656</P> Wed, 26 Jul 2017 18:06:21 GMT kiran331 2017-07-26T18:06:21Z How to use regex to extract field? https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-extract-field/m-p/333890#M99275 <P>HI How to extract the field with space using regex?</P> <P>name:<BR /> T11345DDF ERROR<BR /> T11345SSDF Volume C</P> <P>values:<BR /> 123455-25335535-55454545-5656566-45655-36565656-6656-488656 TPM</P> <P>I need to extract T11345DDF , T11345SSDF , 123455-25335535-55454545-5656566-45655-36565656-6656-488656</P> Wed, 26 Jul 2017 18:06:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-extract-field/m-p/333890#M99275 kiran331 2017-07-26T18:06:21Z Re: How to use regex to extract field? https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-extract-field/m-p/333891#M99276 <P>Let's say that it is always the first word in each event line then can you try this please:</P> <PRE><CODE>your query to return events | rex "^(?&lt;myField&gt;[^\s]+)\s*" | table myField </CODE></PRE> <P>See extraction <A href="https://regex101.com/r/R4RdZ8/1">here</A></P> Wed, 26 Jul 2017 18:16:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-extract-field/m-p/333891#M99276 gokadroid 2017-07-26T18:16:12Z Re: How to use regex to extract field? https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-extract-field/m-p/333892#M99277 <P>Thanks gokadroid.</P> Wed, 26 Jul 2017 18:23:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-extract-field/m-p/333892#M99277 kiran331 2017-07-26T18:23:04Z Re: How to use regex to extract field? https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-extract-field/m-p/333893#M99278 <P>If you need more flexibility you might need to create fields extractions. If it was me, I would create 3 separate field extractions.</P> <PRE><CODE>- (?P&lt;error&gt;.*?)\sERROR - (?P&lt;volume&gt;.*?)\sVolume - (?P&lt;tpm&gt;.*?)\sTPM </CODE></PRE> Thu, 27 Jul 2017 17:59:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-extract-field/m-p/333893#M99278 rbreton 2017-07-27T17:59:46Z