How to use the extracted field expressions using rex command ?

[Real_captain]

HI 

Can someone please let me know how I can use the below expression (generated via Field Extraction) directly via Rex command: 

Regular expression generated via Field extraction:

^(?:[^,\n]*,){7}\s+"\w+_\w+_\w+_\w+_\w+":\s+"(?P<POH>[^"]+)

I am using the rex command as below but i am getting an error : 

| rex field=Message mode=sed "(?:[^,\n]*,){7}\s+"\w+_\w+_\w+_\w+_\w+":\s+"(?P<POH1>[^"]+)"

[inventsekar]

Hi @Real_captain , the mode=sed was not from the field extraction wizard. may i know why you thought to use the mode=sed, pls suggest. 

As you can see, 

Syntax: mode=sed Description: Specify to indicate that you are using a sed (UNIX stream editor) expression. sed-expression Syntax: "<string>" Description: When mode=sed, specify whether to replace strings (s) or substitute characters (y) in the matching regular expression. 

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex#Syntax

not sure, but lets try:

| rex field=Message "(?:[^,\n]*,){7}\s+"\w+_\w+_\w+_\w+_\w+":\s+"(?P<POH1>[^"]+)"

Sample log lines will be helpful to troubleshoot this, thanks.