I have a event which is like below.
"searchString" index=ABC1............XYZ1"/searchString" 123456789 "searchString"index=ABC2.....................XYZ2"/searchString"
I want to extract the data between "searchString" and "/searchString" .
the output should be like below
index=ABC1............XYZ1
index=ABC2.....................XYZ2
In you SPL, you could try this
.... | rex "searchString"\s(?<ss>[^"]*)"\/" | ...