https://community.splunk.com/t5/Splunk-Search/Need-help-on-Rex/m-p/569512#M198503 <LI-CODE lang="markup">| rex "\[(?&lt;CI_Name&gt;[^\]]+)\]\s\["</LI-CODE> Mon, 04 Oct 2021 07:04:22 GMT ITWhisperer 2021-10-04T07:04:22Z https://community.splunk.com/t5/Splunk-Search/Need-help-on-Rex/m-p/569508#M198501 <P>Hi ,</P><P>can some one help me with the rex command to extract the string included in first [] from below pattern. For example: string to filter from below pattern is Proxy - Zscaler,&nbsp;<SPAN>Teams,&nbsp;Exchange and extract&nbsp;it under field "CI_Name"</SPAN></P><P>[Proxy - Zscaler] [xxxxxxxr] USA US-22 Peer 2</P><P><SPAN>[Teams] [xxxxxxx] Mexico Login - MX (proxy)</SPAN></P><P><SPAN>[Exchange] [xxxxx] Mexico Outlook Send Email - MX (proxy)</SPAN></P><P><SPAN>Thanks</SPAN></P> Mon, 04 Oct 2021 06:42:24 GMT https://community.splunk.com/t5/Splunk-Search/Need-help-on-Rex/m-p/569508#M198501 sbhatnagar88 2021-10-04T06:42:24Z https://community.splunk.com/t5/Splunk-Search/Need-help-on-Rex/m-p/569512#M198503 <LI-CODE lang="markup">| rex "\[(?&lt;CI_Name&gt;[^\]]+)\]\s\["</LI-CODE> Mon, 04 Oct 2021 07:04:22 GMT https://community.splunk.com/t5/Splunk-Search/Need-help-on-Rex/m-p/569512#M198503 ITWhisperer 2021-10-04T07:04:22Z https://community.splunk.com/t5/Splunk-Search/Need-help-on-Rex/m-p/569514#M198505 <P>Thanks&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;</P> Mon, 04 Oct 2021 07:38:55 GMT https://community.splunk.com/t5/Splunk-Search/Need-help-on-Rex/m-p/569514#M198505 sbhatnagar88 2021-10-04T07:38:55Z