topic Why am I unable to extract a field from my logs with rex using my current regular expression? in Splunk Search https://community.splunk.com/t5/Splunk-Search/Why-am-I-unable-to-extract-a-field-from-my-logs-with-rex-using/m-p/186996#M53869 <P>In my logs, I have the below part and I want to extract <STRONG>success</STRONG></P> <PRE><CODE>{\"state\":\"success\", </CODE></PRE> <P>How do I formulate it with rex? I know that I should escape the backslashes and quotes but adding a <CODE>\</CODE> does not do the trick. This is what I have tried:</P> <PRE><CODE>| rex "\\\"state\\\":\\\"(?&lt;state&gt;\w*)\\\"" </CODE></PRE> Mon, 16 Mar 2015 18:16:12 GMT mitcanmit 2015-03-16T18:16:12Z Why am I unable to extract a field from my logs with rex using my current regular expression? https://community.splunk.com/t5/Splunk-Search/Why-am-I-unable-to-extract-a-field-from-my-logs-with-rex-using/m-p/186996#M53869 <P>In my logs, I have the below part and I want to extract <STRONG>success</STRONG></P> <PRE><CODE>{\"state\":\"success\", </CODE></PRE> <P>How do I formulate it with rex? I know that I should escape the backslashes and quotes but adding a <CODE>\</CODE> does not do the trick. This is what I have tried:</P> <PRE><CODE>| rex "\\\"state\\\":\\\"(?&lt;state&gt;\w*)\\\"" </CODE></PRE> Mon, 16 Mar 2015 18:16:12 GMT https://community.splunk.com/t5/Splunk-Search/Why-am-I-unable-to-extract-a-field-from-my-logs-with-rex-using/m-p/186996#M53869 mitcanmit 2015-03-16T18:16:12Z Re: Why am I unable to extract a field from my logs with rex using my current regular expression? https://community.splunk.com/t5/Splunk-Search/Why-am-I-unable-to-extract-a-field-from-my-logs-with-rex-using/m-p/186997#M53870 <P>Your regex string worked perfectly on regex101.com, but sometimes Splunk gets confused by quotation marks within strings. Try this alternative:</P> <PRE><CODE>"\\\x22state\\\x22:\\\x22(?&lt;state&gt;\w*)\\\x22" </CODE></PRE> Mon, 16 Mar 2015 18:26:07 GMT https://community.splunk.com/t5/Splunk-Search/Why-am-I-unable-to-extract-a-field-from-my-logs-with-rex-using/m-p/186997#M53870 richgalloway 2015-03-16T18:26:07Z Re: Why am I unable to extract a field from my logs with rex using my current regular expression? https://community.splunk.com/t5/Splunk-Search/Why-am-I-unable-to-extract-a-field-from-my-logs-with-rex-using/m-p/186998#M53871 <P>Give this a try as well </P> <PRE><CODE>your base search | rex "(\\\)*\"state(\\\)*\":(\\\)*\"(?&lt;state&gt;\w*)(\\\)*\"" </CODE></PRE> Mon, 16 Mar 2015 21:00:47 GMT https://community.splunk.com/t5/Splunk-Search/Why-am-I-unable-to-extract-a-field-from-my-logs-with-rex-using/m-p/186998#M53871 somesoni2 2015-03-16T21:00:47Z