Field Extraction using Regex

[abilann]

Hi Team,

I would like to extract table name from below combined event using rex. Both events are combined in one event using transaction. Can you please help,

25324/-285213840 WRK:DF_E4CAC858_tor Thu Apr 9 23:17:25.077194 dbprq.c770
doQueryDiagnostics: The following SQL query took 535 seconds which is equal to or greater than QueryExecutionTimeThreshold (4 seconds) for User(AF) with DBProxyUser(AF).
25324/-285213840 WRK:AF_E4CAC858_tor Thu Apr 9 23:17:25.080304 dbpq.c782
SELECT * FROM PRODDTA.Employee WHERE ( A=1 )

Thanks,
Abilan

[richgalloway]

See if this helps.

... | rex "(?i)FROM (?<table>\S+)"