extract a field and display results in a table

[mrr6892]

i am trying to extract specific words starts with gi. from all events and display in a table below is my string but it returned nothing please advise.

String:

mysearch | rex field=_raw "Start(?<"gi">.*)End"

Event:

/p.rabbitmq/rabbitmq/queues/81061abe-4007-46c4-b9f2-4855cda5ace2/gi.nam.quotesvc.submission.cleared.evt.flq/consumers

[richgalloway]

I take it you're trying to match the bold text.  If so, the current rex command won't work and should be throwing an error because of the unescaped quotation marks in the expression.  Try this:

| rex "(?<gi>gi.*)"

[mrr6892]

i tried but still its not displaying the all value starts with gi. in table by the way below is the exact event i think what ever bold test i am looking is assigned to name: field like below

   name: /p.rabbitmq/rabbitmq/queues/fc99de5c-2a5f-41e2-ba86-2cb662b8e771/gi.nam.submission.intake.cmd.flq/depth