Hello,
Thank you for your help on this in advance, I just need to create a field in Splunk Search that contains the value between 2 delimiters. The delimiter is "?". For example.
Athena.siteone.com?suvathp001?443
What would be the regex to only extract suvathp001
Thanks again for your help,
Tom
 
					
				
		
 
		
		
		
		
		
	
			
		
		
			
					
		The general form for that regex is "<<delimiter>>(?<field>[^<<delimiter>>]+)". In this case, the delimiter is a regex special character so escaping is needed. Try this command:
| rex "\?(?<field>[^\?]+)"