Help with Regex

[kiran331]

Hi

How can I extract the "TCP_MISS/200" and "TCP_MISS_SSL/200" or similar from the event below?

1466609862.644 109 1.2.3.55 TCP_MISS/200 387 POST http://sdsd.com/put "[email protected]" ...........

1466609862.632 17096 2.3.4.167 TCP_MISS_SSL/200 1036 GET https://..................

[richgalloway · Accepted solution]

Try

... | rex "(?<field>TCP[^\s]+)" | ...