https://community.splunk.com/t5/Splunk-Search/Unable-to-view-the-field-created-using-rex/m-p/171874#M49259 <P>Be careful of extra spaces in your rex string. Also, the '(?i)' is unnecessary.</P> Thu, 01 Jan 2015 12:55:35 GMT richgalloway 2015-01-01T12:55:35Z https://community.splunk.com/t5/Splunk-Search/Unable-to-view-the-field-created-using-rex/m-p/171873#M49258 <P>string used in the search rex "(?i) Message= (?P[^.]+)"</P> <P>Event log form where im trying to extract "Message=The Windows Management Instrumentation service entered the running state"</P> Thu, 01 Jan 2015 11:48:18 GMT https://community.splunk.com/t5/Splunk-Search/Unable-to-view-the-field-created-using-rex/m-p/171873#M49258 prabu_harsh12 2015-01-01T11:48:18Z https://community.splunk.com/t5/Splunk-Search/Unable-to-view-the-field-created-using-rex/m-p/171874#M49259 <P>Be careful of extra spaces in your rex string. Also, the '(?i)' is unnecessary.</P> Thu, 01 Jan 2015 12:55:35 GMT https://community.splunk.com/t5/Splunk-Search/Unable-to-view-the-field-created-using-rex/m-p/171874#M49259 richgalloway 2015-01-01T12:55:35Z https://community.splunk.com/t5/Splunk-Search/Unable-to-view-the-field-created-using-rex/m-p/171875#M49260 <P>It worked after removing the extra space. thanks so much! Wish you a happy new year!</P> Thu, 01 Jan 2015 13:35:16 GMT https://community.splunk.com/t5/Splunk-Search/Unable-to-view-the-field-created-using-rex/m-p/171875#M49260 prabu_harsh12 2015-01-01T13:35:16Z https://community.splunk.com/t5/Splunk-Search/Unable-to-view-the-field-created-using-rex/m-p/171876#M49261 <P>For better/future reference,<BR /> Use Interactive Field Extractor<BR /> <A href="http://www.splunk.com/view/SP-CAAADUY">http://www.splunk.com/view/SP-CAAADUY</A></P> <P>Splunk, makes life's easy :).</P> Tue, 06 Jan 2015 15:40:52 GMT https://community.splunk.com/t5/Splunk-Search/Unable-to-view-the-field-created-using-rex/m-p/171876#M49261 neelamssantosh 2015-01-06T15:40:52Z