Help with regex..?

[prakash007]

Need help with regex...should start with " end with space or ?

Need entire string in a field starting with " and end until j.prod or c.cat etc...

 "GET /brit-pocket09fress/cprod121000019___/j.prod HTTP/1.1"

  "GET /nprod789jkj908989heys__/j.prod?icid=&searchType=

  "GET /Zin-carsposn-vwlvet-09878__/c.cat HTTP/1.1"

[woodcock]

Like this:

(?<myCapture>"[^\s]+\s+[^\s?]+)(?<=\/)

[prakash007]

some how it's giving me the date when i do | rex field=_raw (?"[^\s]+\s+[^\s?]+)(?<=\/) | table myCapture, _raw

[somesoni2 · Accepted solution]

Try this

your base search |rex field=yourfield "\"(?<SomefieldName>\S+\s+[^\s\?]+)"