How to extract a string that starts with certain words or letters?

[harry521]

I'd like to use rex to extract the event string that starts with certain words or letters, possibly ends with certain words or letters. For example I have a event string like "blah blah blah Start blah blah blah End".

I can do something like:

mySearch|rex field=_raw "Start(?<"myField">.*)End"

I want my result not only "myField" but also including "Start" and "End". How can I do it?

[woodcock]

Is this a trick question?

 mySearch | rex field=_raw "(?<myField>Start.*End)"

[DalJeanis]

you just move the parenthesis to be around whatever you want to capture.

Then you can go over to regex101.com and test to make sure you got it right. (Over there, you leave off the quotes and occasionally some character-escaping you had to do in splunk.)

[harry521]

I guess I didn't make myself clear. The end result I'd like to show is "Start <"myField"> End" from the original one. I end up with a "dirty" way to implement it as using "eval result=Start.<"myField">.End" to concatenate the strings after extracting myField.

Another way to explain what I want to achieve is to get rid of anything before "Start", and after "End".

[ddrillic]

Something in the spirit of -

| eval _raw="Start 999 End"
| rex field=_raw "(?<aaa>Start \d* End)"

[richgalloway]

mySearch|rex field=_raw "(?<"myField">Start.*End)"