How to regex match?

[kc_prane]

 Hi,

This is a raw log  Job=[IN-SNMMIS-DLY]], 

I am trying to build regex just the words " IN-SNMMIS-DLY]" 

and ignore the parenthesis  

[ITWhisperer]

| rex "Job=\[(?<job>[^\]]+)\]"

[kc_prane]

Thankyou@ITWhisperer

[yuanliu]

I think @ITWhisperer pressed Enter before complete typing. (This happened to me today, too. Something on the forum interface might be off.)  Assuming the field Job is already extracted, a usable regex would be "^\[.+\]$".  To use in rex command:

|rex field=Job "^\[(?<Job_no_bracket>.+)\]$"

If Job is not extracted and you are only interested in the part inside brackets,

| rex "=\[(?<Job_no_bracket>.+)\]$"

This last one only works if there's nothing after "Job=[IN-SNMMIS-DLY]]" in _raw.

[kc_prane]

Thanks a lot, @Yuanilu that regex worked for me.