Extracting data in between unique characters

[behymejt2012]

Hi Everyone,

I am still new to Splunk and have found myself in a predicament for extracting a specific value, within a value. So for the following:

usb#android(04e8) mass storage(685e)#abc123abc123

I am trying to extract everything between # and # so essentially "android(04e8) mass storage(685e)". I have head about using regex/rex but I wasn't sure if there was an eval function that could perform this?

[Ayn · Accepted solution]

Why not use regex? 🙂

rex "#(?<yourfieldname>.+?)#"

[behymejt2012]

Perfect. Was also looking at I would pull all the content from the beginning to a specific character ")". Ex from above: "android"

Also, any recommended avenues for learning this version of regex (books, articles, etc)