I would like to extract a string from a field which contains Space characters.
This is the Text Field that is already extracted:
<Text>Launched application: FilmView, PID: 5180</Text>
I used the following search:
rex field=Text ": (? Application> \w+) ,"
I didn't work for me. What should be the right command?
If it can be done, I would like to extract the PID field as well.
| rex field=Text "application: (?<Application>[^\,]+)\, PID: (?<PID>\d+)"