How to extract language field

[martin_mueller]

Converted from http://answers.splunk.com/answers/193524/how-to-write-a-search-to-return-events-with-a-vari.html

Hi,

i want to extract this field language:

language:ru-ru

can you please help me what regular expression should i write?

Thanks,
Snabel

[martin_mueller · Accepted solution]

Try this:

language:(?<language>\w+-?\w*)

In the long run you should consider setting up key-value extraction around the colon instead of the equals sign.