How to extract 2 fields using rex?

[LizAndy123]

Hi, I am new to SPL and have figured out how to do one rex Field extract - like this

index=xxxxx  "PUT /app/1/projects" | rex field=_raw "HTTP\/1\.1\" (?P<Status_Code>[^\ ]*)"

this is from the following search results log line HTTP/1.1" 200 44 188

This gives me the Status code and I can sort them and report - example 200 , 201, 400 or 500

I need to use the last field (2 or 3) digits to get the speed - how would I do that - I am stuck with formatting

Thanks in advance

[ITWhisperer]

| rex "HTTP\/\d\.\d\"\s(?<Status_Code>\d+).*?(?<speed>\d+)$"

[LizAndy123]

Thanks this worked - I never came back on to say

[yuanliu]

---

this is from the following search results log line HTTP/1.1" 200 44 188

How about

| rex "HTTP/1.1\"\s+(?<Status_Code>\d+)\s+(?<field2>\d+)\s+(?<field3>\d+)"