https://community.splunk.com/t5/Splunk-Enterprise/How-to-write-regex/m-p/643910#M16379 <P><A href="https://regex101.com/r/2G9G0h/1" target="_blank">https://regex101.com/r/2G9G0h/1</A></P><LI-CODE lang="markup">appDesc\"\s:\s\"(?&lt;appDesc&gt;[^\"]+)</LI-CODE><LI-CODE lang="markup">| rex max_match=0 "appDesc\"\s:\s\"(?&lt;appDesc&gt;[^\"]+)"</LI-CODE> Fri, 19 May 2023 13:26:30 GMT ITWhisperer 2023-05-19T13:26:30Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-write-regex/m-p/643904#M16377 <P>form the below logs i want to capture&nbsp; "appDesc" data using regex.</P> <P>&nbsp;</P> <LI-CODE lang="markup">2023-05-02 22:27:20,100 | info application status https:www.codeurl [ Response: 200 ok- https:www.codeurl "appDesc" : "User not within error limit" { "appcd" : "0", "appDesc" : "fraud app dected risk tolerance" } ],</LI-CODE> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <LI-CODE lang="markup">2023-05-02 22:27:20,100 | info application status https:www.codeurl [ Response: 200 ok- https:www.codeurl "appDesc" : "User not within error limit" { "appcd" : "0", "appDesc" : "fraud app dected risk tolerance" } ],</LI-CODE> <P>&nbsp;</P> <P>&nbsp;</P> Fri, 19 May 2023 13:12:20 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-write-regex/m-p/643904#M16377 Ash1 2023-05-19T13:12:20Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-write-regex/m-p/643910#M16379 <P><A href="https://regex101.com/r/2G9G0h/1" target="_blank">https://regex101.com/r/2G9G0h/1</A></P><LI-CODE lang="markup">appDesc\"\s:\s\"(?&lt;appDesc&gt;[^\"]+)</LI-CODE><LI-CODE lang="markup">| rex max_match=0 "appDesc\"\s:\s\"(?&lt;appDesc&gt;[^\"]+)"</LI-CODE> Fri, 19 May 2023 13:26:30 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-write-regex/m-p/643910#M16379 ITWhisperer 2023-05-19T13:26:30Z