Hi Yuanliu!
Sorry for the delayed reply, I'm currently only alloowed 2 replies a day. I had this comment ready to go yesterday.
"Actually, I have it!
I just used two separate rex's. One to remove junk from the start of the wanted part of the string and a second one to remove stuff after the wanted part of the string.
Thanks anyway for your help Yuanliu!"
The regex I had above was good for finding the values in the middle of the string but didn't work ideally for Splunk.
Thanks for your suggestions though, very much appreciated!
Cheers,
Chris
... View more