How to extract a field using rex that contains backslash and double quotation marks?

[retro-bloke]

in the raw event there is a line that goes Brand\="xyz"

What's the rex command I can use to extract this in my search?

If possible, I'd like to remove the \ and "" from the extraction itself.

[inventsekar]

Hi @retro-bloke ... May i know if you are looking for a rex search query 

or..

you want to update the props.conf file for the purpose of field extraction, please confirm, thanks.

[retro-bloke]

Hi @inventsekar, I am looking for a rex search query

[inventsekar]

Hi @retro-bloke 

Please check this: (you may need to modify little bit, depending on your logs.. if this does not work, pls give us some sample events)

| makeresults | eval temp="the test event is Brand\=\"xyz\"" 
|rex field=temp "(?P<brand>\w+)\"" 
|table temp brand

[retro-bloke]

I found that this also works

rex "Brand\\\=\"(?<brand>.*?)\""

the triple quotation marks escape the \, the \" surrounding the () handles the quotation marks in the event itself.