How to select only the procedure marked in bold through regex

[JyotiP]

Completed executing query test_proc_SelectLatest_PricesBySecurity which took 1 milliseconds.
Completed executing query test_proc_Select_ForCloseouts which took 42 milliseconds.
Completed executing query test_proc_Insert which took 12 milliseconds.
Completed executing query test_UnprocessedLot_Select which took 142 milliseconds.

[kmaron]

Try this:

| rex field=_raw "Completed executing query (?<Procedure>.*?) which took"

[niketn]

@JyotiP, can you please try the following? It extracts the procedure name and execution time(assuming time is always logged in milliseconds) .

<yourBaseSearch>
| rex "Completed executing query (?<procedure>[^\s]+)\swhich took (?<execution_time>[^\s]+)\smilliseconds."