https://community.splunk.com/t5/Splunk-Search/Help-with-regex/m-p/628220#M218233 <P>Hi community.&nbsp;</P><P>Some searches have:<BR />index="my_index"<BR />index=my_index</P><P>I want to extract a new field named user_index but cannot figure out the regex capture group that may or may not contain quotes around the index name.</P><P>&nbsp;</P><P>&nbsp;</P> Wed, 25 Jan 2023 04:17:12 GMT hank72 2023-01-25T04:17:12Z https://community.splunk.com/t5/Splunk-Search/Help-with-regex/m-p/628220#M218233 <P>Hi community.&nbsp;</P><P>Some searches have:<BR />index="my_index"<BR />index=my_index</P><P>I want to extract a new field named user_index but cannot figure out the regex capture group that may or may not contain quotes around the index name.</P><P>&nbsp;</P><P>&nbsp;</P> Wed, 25 Jan 2023 04:17:12 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-regex/m-p/628220#M218233 hank72 2023-01-25T04:17:12Z https://community.splunk.com/t5/Splunk-Search/Help-with-regex/m-p/628222#M218234 <P>I figured it out.<BR /><BR />index=(\"|)(?P&lt;user_index&gt;[^ "]+)</P><P>&nbsp;</P> Wed, 25 Jan 2023 05:50:31 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-regex/m-p/628222#M218234 hank72 2023-01-25T05:50:31Z