Regex to extract quoted text aftera stats command

[cindygibbs_08]

I hope everyone is having a great time today,
I am here to first thank you guys for being so helpful and assertive! you people rock! and second to ask for assistance regarding a regular expression.
I have a field that will contain a string that will start by "check-in unavailable due to external cause the ref code is ##AIUI- 989 K-IOJ##"
I want to be able to extract the string that is between the "##"  but... sometimes this field may have a string that starts by "the auth was..." I want to be able to extract any string   between two "#" whenever the value of the field starts with  "check-in unavailable due to external cause the ref code is"  

for example
 if I have this:

FIELD	CODE
"check-in unavailable due to external cause the ref code is ##AIUI- 989 K-IOJ##	AIUI- 989 K-IOJ
"the auth was denied code ## uik-55855##"	N.A

thank you guys SO MUCH

Kindy,

Cindy

[ITWhisperer · Accepted solution]

| makeresults 
| eval _raw="check-in unavailable due to external cause the ref code is ##AIUI- 989 K-IOJ##
the auth was denied code ## uik-55855##"
| multikv noheader=t
| fields _raw
| rex "check-in unavailable due to external cause the ref code is ##(?<code>[^#]+)##"

[cindygibbs_08]

I have a question what would the rex function will look like if instead of two "#" the coude would come inside two "*"  like this :  **UID J- DIDD**, I would just change the "#" by "*"??

[ITWhisperer]

Asterisks "*" have special meaning in regex so each would need to be escaped with a backslash "\"

| makeresults 
| eval _raw="check-in unavailable due to external cause the ref code is **AIUI- 989 K-IOJ**
the auth was denied code ** uik-55855**"
| multikv noheader=t
| fields _raw
| rex "check-in unavailable due to external cause the ref code is \*\*(?<code>[^\*]+)\*\*"

[cindygibbs_08]

@ITWhisperer  I am in love with you

[ITWhisperer]

Thanks Cindy ❤️😁