https://community.splunk.com/t5/Getting-Data-In/RegEx-data-after-curly-brackets/m-p/705077#M116625 <P>I'm trying to regex the field that has "REPLY"<BR />CommonEndpointLoggingAspect {requestId=94f2a697-3c0d-4835-b96a-42be3d2426e2, serviceName=getCart} - REPLY&nbsp;</P> Fri, 22 Nov 2024 18:50:40 GMT CPrimoR 2024-11-22T18:50:40Z https://community.splunk.com/t5/Getting-Data-In/RegEx-data-after-curly-brackets/m-p/705077#M116625 <P>I'm trying to regex the field that has "REPLY"<BR />CommonEndpointLoggingAspect {requestId=94f2a697-3c0d-4835-b96a-42be3d2426e2, serviceName=getCart} - REPLY&nbsp;</P> Fri, 22 Nov 2024 18:50:40 GMT https://community.splunk.com/t5/Getting-Data-In/RegEx-data-after-curly-brackets/m-p/705077#M116625 CPrimoR 2024-11-22T18:50:40Z https://community.splunk.com/t5/Getting-Data-In/RegEx-data-after-curly-brackets/m-p/705078#M116626 <P>What have you tried so far?&nbsp; Was it anything like this?</P><LI-CODE lang="markup">| rex "\}\s*-\s*(?&lt;field&gt;.*)"</LI-CODE> Fri, 22 Nov 2024 19:44:36 GMT https://community.splunk.com/t5/Getting-Data-In/RegEx-data-after-curly-brackets/m-p/705078#M116626 richgalloway 2024-11-22T19:44:36Z