How to cut the value using REX command

[Luninho]

I have the field - DATE, for example:

DATE: ^9F33006E0F848^00950108080008000^9F37008B1832B33^9F1E0163236353132303337^9F26016B9F12AB2FA191854^9F36003003F^00820041980^009C00200^9F1A0040643^009A006210114^9F02012000000058700^5F2A0040643^9F03012000000000000^9F2700280^9F340061F0002^9F3500222^0084014A0000006581010^9F090040002^9F41006023804^9F100640FA501A030002000ED085B191CB9E97C10040000000000000000000000000000

I need to cut only ^9F10*, for example:

DATE: ^9F100640FA501A030002000ED085B191CB9E97C10040000000000000000000000000000

How to do it?

[to4kawa]

index=_internal | head 1 | fields _raw
| eval _raw="DATE
^9F33006E0F848^00950108080008000^9F37008B1832B33^9F1E0163236353132303337^9F26016B9F12AB2FA191854^9F36003003F^00820041980^009C00200^9F1A0040643^009A006210114^9F02012000000058700^5F2A0040643^9F03012000000000000^9F2700280^9F340061F0002^9F3500222^0084014A0000006581010^9F090040002^9F41006023804^9F100640FA501A030002000ED085B191CB9E97C10040000000000000000000000000000"
| multikv forceheader=1
| rex field=DATE max_match=0 "(?<date>\^9F10\w+)"

[gcusello]

Hi @Luninho,

let me understand: you want to extract from "9F10" to the end of the DATA fields, is it correct?

If this is your need, please, try this regex:

| rex field=DATE "(?<my_field>9F10.*)"

that you can test at https://regex101.com/r/iMI4QH/1

Ciao.

Giuseppe

[ITWhisperer]

| rex field=DATE "(?<DATE>\^9F10[^\^]+)"

Is this what you really want? Or do you want to split the field by ^ delimiters into multiple values? Or something else?