topic Re: rex help plz in Splunk Search https://community.splunk.com/t5/Splunk-Search/rex-help-plz/m-p/300305#M90413 <PRE><CODE>| rex field=_raw "sessionID\":\"(?P&lt;sessionID&gt;[^\"\:]+)" </CODE></PRE> Wed, 15 Feb 2017 16:23:28 GMT starcher 2017-02-15T16:23:28Z rex help plz https://community.splunk.com/t5/Splunk-Search/rex-help-plz/m-p/300304#M90412 <P>"sessionID":"ABCDFE-112451x55-3734-4601-82a9-7ab6c5151d85"<BR /> "sessionID":"123456789012"<BR /> "sessionID":"12dsfvvxv3"</P> <P>Please help me with rex to extract this from _raw</P> Wed, 15 Feb 2017 16:00:33 GMT https://community.splunk.com/t5/Splunk-Search/rex-help-plz/m-p/300304#M90412 sravankaripe 2017-02-15T16:00:33Z Re: rex help plz https://community.splunk.com/t5/Splunk-Search/rex-help-plz/m-p/300305#M90413 <PRE><CODE>| rex field=_raw "sessionID\":\"(?P&lt;sessionID&gt;[^\"\:]+)" </CODE></PRE> Wed, 15 Feb 2017 16:23:28 GMT https://community.splunk.com/t5/Splunk-Search/rex-help-plz/m-p/300305#M90413 starcher 2017-02-15T16:23:28Z Re: rex help plz https://community.splunk.com/t5/Splunk-Search/rex-help-plz/m-p/300306#M90414 <P>got it thanks</P> Wed, 15 Feb 2017 16:41:03 GMT https://community.splunk.com/t5/Splunk-Search/rex-help-plz/m-p/300306#M90414 sravankaripe 2017-02-15T16:41:03Z