Help me with Rex in search query

[sravankaripe]

"sessionID":"123456567"
"sessionID":"ABCnsh8ah"

Please help me with Rex to pick
123456567
ABCnsh8ah

from above _raw event

[hhGA]

Hi,

Give this a shot:

rex field=_raw> "\"sessionID\":\"(?<field>\S+)\""

[adayton20]

Try this:

| rex field=_raw "sessionID\"\:\"(<sessionID>.[^\"]*)"

[koshyk · Accepted solution]

Please try

<raw_search> | rex  "sessionID\":\"(?<mysessionID>[\d\w]+)\""| table mysessionID

Full example with sample data

|makeresults | eval _raw="\"sessionID\":\"123456567\""|  rex  "sessionID\":\"(?<mysessionID>[\d\w]+)\""| table mysessionID