topic Re: How to extract value under double quotes using the rex command? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-extract-value-under-double-quotes-using-the-rex-command/m-p/384540#M112305 <P>Try this:</P> <PRE><CODE>... | rex "busy for \"(?&lt;one&gt;\d+)" | ... </CODE></PRE> Wed, 22 May 2019 12:44:43 GMT richgalloway 2019-05-22T12:44:43Z How to extract value under double quotes using the rex command? https://community.splunk.com/t5/Splunk-Search/How-to-extract-value-under-double-quotes-using-the-rex-command/m-p/384539#M112304 <P>Has been busy for "639" seconds </P> <P>using rex command i need to extract value 639 and store it in one field.</P> <P>Please help !!!</P> Wed, 22 May 2019 11:16:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-value-under-double-quotes-using-the-rex-command/m-p/384539#M112304 saravanafd 2019-05-22T11:16:33Z Re: How to extract value under double quotes using the rex command? https://community.splunk.com/t5/Splunk-Search/How-to-extract-value-under-double-quotes-using-the-rex-command/m-p/384540#M112305 <P>Try this:</P> <PRE><CODE>... | rex "busy for \"(?&lt;one&gt;\d+)" | ... </CODE></PRE> Wed, 22 May 2019 12:44:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-value-under-double-quotes-using-the-rex-command/m-p/384540#M112305 richgalloway 2019-05-22T12:44:43Z Re: How to extract value under double quotes using the rex command? https://community.splunk.com/t5/Splunk-Search/How-to-extract-value-under-double-quotes-using-the-rex-command/m-p/384541#M112306 <P>Thank you very much for the resolution. Works perfectly <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Wed, 22 May 2019 13:04:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-value-under-double-quotes-using-the-rex-command/m-p/384541#M112306 saravanafd 2019-05-22T13:04:38Z Re: How to extract value under double quotes using the rex command? https://community.splunk.com/t5/Splunk-Search/How-to-extract-value-under-double-quotes-using-the-rex-command/m-p/384542#M112307 <P>Hi</P> <P>Try this</P> <PRE><CODE>| makeresults | eval msg ="busy for \"639\" seconds" | rex field=msg "\"(?P&lt;seconds&gt;[\d]+)\"" </CODE></PRE> Wed, 22 May 2019 13:06:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-value-under-double-quotes-using-the-rex-command/m-p/384542#M112307 vnravikumar 2019-05-22T13:06:48Z