https://community.splunk.com/t5/Splunk-Search/What-s-Wrong-With-This-Query/m-p/532911#M150545 <LI-CODE lang="markup">| rex "X\-Request\-Id\:\[(?&lt;x_request_id&gt;.{36})"</LI-CODE> Sat, 12 Dec 2020 19:14:47 GMT ITWhisperer 2020-12-12T19:14:47Z https://community.splunk.com/t5/Splunk-Search/What-s-Wrong-With-This-Query/m-p/532910#M150544 <P>Hi,</P><P>&nbsp;</P><P>Any thought off-hand as to what I'm not accounting for?</P><P>Looking to extract values from a field in unstructured logs.</P><P>Example event:<BR /><BR />... { X-Request-Id:[&lt;36_characters_of_interest&gt;] .....<BR /><BR />Was attempting to pull it from a named capture group (whose regex itself matches the correct characters), but no luck with any data showing up in the table.<BR /><BR />index="k8s_events" real-estate-app X-Request-Id<BR />| regex (?&lt;x_request_id&gt;(?&lt;=X\-Request\-Id\:\[).............................................)<BR />| table x_request_id</P> Sat, 12 Dec 2020 18:41:24 GMT https://community.splunk.com/t5/Splunk-Search/What-s-Wrong-With-This-Query/m-p/532910#M150544 ahcarpenter 2020-12-12T18:41:24Z https://community.splunk.com/t5/Splunk-Search/What-s-Wrong-With-This-Query/m-p/532911#M150545 <LI-CODE lang="markup">| rex "X\-Request\-Id\:\[(?&lt;x_request_id&gt;.{36})"</LI-CODE> Sat, 12 Dec 2020 19:14:47 GMT https://community.splunk.com/t5/Splunk-Search/What-s-Wrong-With-This-Query/m-p/532911#M150545 ITWhisperer 2020-12-12T19:14:47Z https://community.splunk.com/t5/Splunk-Search/What-s-Wrong-With-This-Query/m-p/532913#M150547 <P>Thank you!!</P> Sat, 12 Dec 2020 20:35:19 GMT https://community.splunk.com/t5/Splunk-Search/What-s-Wrong-With-This-Query/m-p/532913#M150547 ahcarpenter 2020-12-12T20:35:19Z