How to extract portions of an event? - Splunk Community

Splunk Search

I have a event which is like below.

"searchString" index=ABC1............XYZ1"/searchString" 123456789 "searchString"index=ABC2.....................XYZ2"/searchString"

I want to extract the data between "searchString" and "/searchString" .
the output should be like below

index=ABC1............XYZ1
index=ABC2.....................XYZ2

In you SPL, you could try this

.... | rex "searchString"\s(?<ss>[^"]*)"\/" | ...

Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...