REGEX

[a88arun]

I want to get the result of  'AccessControlRuleName' in a separate field set using REGEX. 

Sample log:

"AccessControlRuleName: PCIWAN_Access_In_#4-no-lookup," 

What would be the Regex query or detail to create a new field set for the above? Need some help on this.

[ITWhisperer]

Assuming the value is always delimited by a comma, try this

| rex "AccessControlRuleName:\s+(?<AccessControlRuleName>[^,]+)"

[a88arun]

Hi ...Thanks for the quick response for my regex query.