How to extract fields with a trailing space after the delimiter character "=" (ex: Code= 999)?

[arnabsen1234]

Hi All,

I have a snippet as below :

  requestId="8b749da4-2996-437f-954d-2b679cd3239b"  Transaction Id= 1234, Alpha= 56789, Beta= 09876, Code= 999

I want to extract this Code.
Please note that "Code" has trailing = with space.

How do I extract this?

[bmacias84]

try this one

 ... | rex field=_raw "Code=\s+(?<code>[^\s,]+)" | table code

[sk314]

Try this:

... | rex field=_raw "Code=\s*(?<code>\d+)" | table code

[arnabsen1234]

This does not seem to be working. I am getting blank blank values for code

[sk314]

Could you post a sample event in its entirety?

[somesoni2]

Try replacing \d+ with \w+