How to extract only first occurrence between two strings in the paragraph of string in Splunk?

[rpachamuthu]

Extract only first occurrence between two strings in the paragraph of string in splunk

index=perf-*** source=*ResponseDataErrorAnalyzer*
|rex field=_raw "scriptnamestart(?<ScriptName>[\w\D]+)scriptnameend"
|table ScriptName

I want to capture the first occurrence an store in the  ScriptName  and display in the table data
scriptnamestartreceiving_S02_sat_Getscriptnameend<someText>scriptnamestartReceiving_S02_sat_Getscriptnameend<someText>

[rut]

The match continues until the second instance of “scriptnameend”. The following pattern uses a lookahead, so it should break at the first instance of “scriptnameend”:

| rex field=_raw "scriptnamestart(?<ScriptName>.+?(?=scriptnameend))scriptnameend"

 I tested the above, it returns “receiving_S02_sat_Get”.

[richgalloway]

I missed the embedded terminator.  Use a non-greedy quantifier to stop at the first occurrence.

| rex "scriptnamestart(?<ScriptName>[\w\D]+?)scriptnameend"

[rut]

That's a more effective pattern (148 vs 178 steps), use @richgalloway's pattern :)!

[richgalloway]

You have expressed a desire and provided a means to achieve that desire.  How did the query fail you?

By default, the rex command will return only the first match.  According to regex101.com, your query should return "receiving_S02_sat_Getscriptnameend<someText>scriptnamestartReceiving_S02_sat_Get" from the sample text.  Is that not what you want?