- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I need to extract a string from a message body, and make a new field for it.
<Junk_Message> #body | Thing1 | Stuff2 | meh4 | so on 1 | extra stuff3 | Blah4 </Junk_Message>
I just need the text that start with #body and end with Blah4. To make things more fun everything after #body generates randomly.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


It would help to know what you've tried so far and how those attempts failed you.
One method that works well for me is the rex command. This regex matches everything after "Junk_Message>" until the following "<" and puts it into a field called Junk_Message.
| rex "Junk_Message>(?<Junk_Message>[^\<])"
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


It would help to know what you've tried so far and how those attempts failed you.
One method that works well for me is the rex command. This regex matches everything after "Junk_Message>" until the following "<" and puts it into a field called Junk_Message.
| rex "Junk_Message>(?<Junk_Message>[^\<])"
If this reply helps you, Karma would be appreciated.
