Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: How to extract a field using rex?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is the string in the log
I 2019-05-23 18:22:38.984Z 7881 216 XObk7A6CU-I62gr3UIKfXQAAAAs 1@43465473@A WPB-Log: file=/users/aa/test.cls method=fetchdata ID=Qwe123
I want to extract a field marked as bold to build a table.
Please note that all strings are variable so the rex should be generic.
Thanks for the help!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Assuming that data is always in the same place this should grab it:
| rex "\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{3}Z \d+ \d+ (?<fieldName>[^\s]+)"
You'll need to choose the field name you want and replace fieldName with whatever you want to label that field. Here's a link to regex 101 that shows it working on the single example you provided: https://regex101.com/r/TdkzcA/1
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Give this a try (assuming the value you want to extract is 6th element from the start)
your base search
| rex "^(\S+\s+){5}(?<YourField>\S+)"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It worked too
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Assuming that data is always in the same place this should grab it:
| rex "\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{3}Z \d+ \d+ (?<fieldName>[^\s]+)"
You'll need to choose the field name you want and replace fieldName with whatever you want to label that field. Here's a link to regex 101 that shows it working on the single example you provided: https://regex101.com/r/TdkzcA/1
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
[Puzzles] Solve, Learn, Repeat: Matching cron expressions
Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass
May 2026 Splunk Expert Sessions: Security & Observability
