https://community.splunk.com/t5/Splunk-Search/How-to-use-rex-to-isolate-fields-with-double-quotes/m-p/591307#M205853 <P>thank you for the feedback, that worked nicely!</P> Tue, 29 Mar 2022 16:57:23 GMT Foss 2022-03-29T16:57:23Z https://community.splunk.com/t5/Splunk-Search/How-to-use-rex-to-isolate-fields-with-double-quotes/m-p/591297#M205850 <P>Hello I am trying to isolate 'msg' field with multiple quotes and when I use rex is either cannot grab what I need or it continues through the data and doesn't stop, thanks!</P> <P>outcome="Success"<STRONG>msg="The "Account is trusted for delegation" property was modified from No to Yes"</STRONG>cs3="</P> <P>I have tried&nbsp;| rex field=_raw "msg=\"(?&lt;msg&gt;[^\"]+)" with no success.</P> Tue, 29 Mar 2022 16:21:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-rex-to-isolate-fields-with-double-quotes/m-p/591297#M205850 Foss 2022-03-29T16:21:25Z https://community.splunk.com/t5/Splunk-Search/How-to-use-rex-to-isolate-fields-with-double-quotes/m-p/591304#M205852 <P>If you cannot predict how many quotes will appear in this "field", there &nbsp;is no general solution. &nbsp;Your best bet is to bet on that "cs3=" will follow "msg" field.</P><LI-CODE lang="markup">| rex "msg=\"(?&lt;msg&gt;.+)\"\s*cs3="</LI-CODE><P>If that is not the case, you can try matching exactly even (0, 2, 4, ...) quotes inside quotes, like</P><LI-CODE lang="markup">| rex "msg=\"(?&lt;msg&gt;([^\"]+\"){0,2,4}[^\"]+)\""</LI-CODE><P>&nbsp;</P> Tue, 29 Mar 2022 16:26:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-rex-to-isolate-fields-with-double-quotes/m-p/591304#M205852 yuanliu 2022-03-29T16:26:47Z https://community.splunk.com/t5/Splunk-Search/How-to-use-rex-to-isolate-fields-with-double-quotes/m-p/591307#M205853 <P>thank you for the feedback, that worked nicely!</P> Tue, 29 Mar 2022 16:57:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-rex-to-isolate-fields-with-double-quotes/m-p/591307#M205853 Foss 2022-03-29T16:57:23Z