How to extract all the fields after a certain string in splunk

[aaa2324]

In below eg I have some random text after the word type and I want to extract all the strings/ numbers that comes after type, can it be done using Rex ? Please suggest the command 

type abc xyz aabbbbc xxxxyyyy bbbbb uuuuuu 12345677

[gcusello · Accepted solution]

Hi @aaa2324,

if you want to extract all the text after "type", you have to use a regex like the following:

| rex "type\s+(?<your_field>.*)"

Ciao.

Giuseppe

[aaa2324]

Thanks a lot it works 👍

[gcusello]

Hi @aaa2324,

Good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉