https://community.splunk.com/t5/Splunk-Search/How-to-write-regex-for-rex-command-to-extract-value-after-a/m-p/197949#M57231 <PRE><CODE>... | rex "API\s\:\sIO\sET\s\:\"(?&lt;myvalue&gt;\d+)ms\"" | table myvalue </CODE></PRE> <P>That will also capture based on the text match before, leading up to the quotes, capture in the quotes up to the ms label.</P> Fri, 06 Feb 2015 04:00:26 GMT esix_splunk 2015-02-06T04:00:26Z https://community.splunk.com/t5/Splunk-Search/How-to-write-regex-for-rex-command-to-extract-value-after-a/m-p/197947#M57229 <P>Hi,<BR /> Can any one help me how to display the below value which is in double quotation using rex command<BR /> API : IO ET :"2465ms"</P> Thu, 28 Aug 2014 18:55:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-regex-for-rex-command-to-extract-value-after-a/m-p/197947#M57229 valameti 2014-08-28T18:55:05Z https://community.splunk.com/t5/Splunk-Search/How-to-write-regex-for-rex-command-to-extract-value-after-a/m-p/197948#M57230 <PRE> ....| rex "(?i)\s\:\"(?P<DURATION>.*?\d+ms)\W" | table DURATION </DURATION></PRE> Thu, 28 Aug 2014 19:23:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-regex-for-rex-command-to-extract-value-after-a/m-p/197948#M57230 pradeepkumarg 2014-08-28T19:23:44Z https://community.splunk.com/t5/Splunk-Search/How-to-write-regex-for-rex-command-to-extract-value-after-a/m-p/197949#M57231 <PRE><CODE>... | rex "API\s\:\sIO\sET\s\:\"(?&lt;myvalue&gt;\d+)ms\"" | table myvalue </CODE></PRE> <P>That will also capture based on the text match before, leading up to the quotes, capture in the quotes up to the ms label.</P> Fri, 06 Feb 2015 04:00:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-regex-for-rex-command-to-extract-value-after-a/m-p/197949#M57231 esix_splunk 2015-02-06T04:00:26Z