I have a search query i like to understand what how regex field extraction is done for source in below query

[chandra61446]

I have a search query i like to understand what how regex field extraction is done for source in below query

Index= * "Error - [ServerError] ValidateMailDatabase: Database is not FT-indexed" | rex field=source "Policy\\\\+(?.*)\\\\" | rex field=source "Email\\\\+(?.*)\\\\"

[nickhills]

Ok, So i would "think" that the intent of the regex is to look at the source of the data, and extract from that either a policy or email value (possibly both) however, the syntax for an inline rex expression is wrong!

I am assuming that the source of these logs is something like:
e:\logs\policy\MyPolicy\somelog.log
or
e:\logs\Email\your.name@email\somelog.log

(but that is quite a wild shot in the dark)

If I am correct (or close) you should update the query to:
| rex field=source "Policy\\+(?<policy>.*)\\" | rex field=source "Email\\+(?<email>.*)\\"
Which basically says "look for a string beginning with the word "Policy" followed by a single "\" then extract all the characters before the trailing "\", and write them to a field called "policy"

If you share you source name, I can validate (or correct) my guess.

[nickhills]

I'm not sure I understand your question, but this maybe as a result of how its been formatted.

Can you edit your answer and post the query using the 10101 option which will show the formatting correctly.
Are you asking what the two rex statements are trying to extract?

[chandra61446]

Are you asking what the two rex statements are trying to extract? Yes exactly.