Splunk Search

Extract string and place in new field

sogeniusio
Path Finder

Trying to extract a string into a new field. A sample of log is as follows:

productName = Special Day Argyle Socks for Men (Special Day Argyle Socks Size 10-13)

| rex "productName\s=\s(?<ProductName>\s[\w\W]+)"

Not sure where to go from here. When I test within regex101, it works just fine. But when I move to Splunk i get nothing.

Update

Added this but now it doesn't stop at a new line

| rex "productName\s=\s(?<ProductName>[\w\W]+\n)"
0 Karma
1 Solution

sogeniusio
Path Finder

Figured it out

| rex "productName\s=\s(?<ProductName>.*)"

View solution in original post

0 Karma

sogeniusio
Path Finder

Figured it out

| rex "productName\s=\s(?<ProductName>.*)"
0 Karma

cpetterborg
SplunkTrust
SplunkTrust

I've changed your comment to an answer. Please accept your answer so that it can be noted as having been answered to your satisfaction. You should earn a badge for doing so as a result. 🙂

0 Karma

sogeniusio
Path Finder

Cheers, Thanks!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...