Extracting BUILDING value using rex

[sgulhane5]

Hi Team,

I've below extensible attributes in message tab, able to extract Assignor ID and it's Value but facing issue for BUILDING and It's Value. I guess because value is under special characters i.e. ["NOI_SEC60_GF"]] 

network_view=default extensible_attributes=[[name="Assignor ID",value="51806153"],[name="BUILDING",value=["NOI_SEC60_GF"]]

I tried few solution but it's not working. @MuS 

Thanks,

[sgulhane5]

Thanks a lot @ITWhisperer 

[sgulhane5]

Thanks, @ITWhisperer 

[sgulhane5]

I tried below command

|rex max_match=0 field=_raw "BUILDING\",value=\"(?<Building>.*?)\s*(\w*+)\]"| eval Building= substr(Building, 1, len(Building)-1)|

[ITWhisperer · Accepted solution]

|rex max_match=0 field=_raw "BUILDING\",value=\[\"(?<Building>[^\"]*)\"\]"

[ITWhisperer]

What have you tried already? If you are using rex and matching against "name" and "value", are you using max_match=0 to get more than one match?