How to extract key value pair from string?

[Mofizul]

Have a search result as

GET https://…. | Status: 403 | Message: Forbidden | Duration: 166 | x-req-id: ssv5s-ssy67-78vshb | x-correlation-id: vsvsuj-75sys7-sbbjs7

Need to extract value of x-req-id .

Tried this extract pairdelim="|" , kvdelim=":" ,which gives Status & Message & Duration but not able to fetch  x-req-id

[ITWhisperer]

This works for me - which version of splunk are you using?

| makeresults
| eval _raw="GET https://…. | Status: 403 | Message: Forbidden | Duration: 166 | x-req-id: ssv5s-ssy67-78vshb | x-correlation-id: vsvsuj-75sys7-sbbjs7"
| extract pairdelim="|" kvdelim=":"

[Mofizul]

Splunk 8.2.2.1

[ITWhisperer]

Same here - so does my run anywhere example work for you?

[Mofizul]

No its not working

[ITWhisperer]

Do you get any errors reported which might help determine what the issue might be other than "its not working"?