How to extract a string from _raw?

[avadhutha]

I have a string like below and unable to extract accuratly with rex command please suggest  any alternative way.

_raw----------------

{lable:harish,message: Say something, location:India, state:TS,qual:xyz}

{message: say nothing,lable:harish, location:India, state:TS,qual:xyz}

{lable:harish, location:India, state:TS,qual:xyz,message: say splunk splunk answers}

The message value is randomized location and I need to pick the message value.

When I try with below command it is not considering the proper end position. Please suggest

|rex "message:(?<Message_value>.*)[,|}]" |table Message_Value

[ITWhisperer · Accepted solution]

Field names are case-sensitive, also, you are using a greedy match which may pick up more than you bargained for - try this

|rex "message:(?<Message_Value>.*?)[,|}]" |table Message_Value

[avadhutha]

Thank you so much.., I was trying a lot of thing like field extraction and regex and you helped it well with ?.