How to write a regular expression for my field?

[sravankaripe]

i want to extract field by regular expression. how can i write regular expression for the below one?

"responseCode":"200"

[horsefez]

Hi sravankaripe,

 | rex field=_raw "(?:.*responseCode\s?\:\s?)(?<response_code>\d+)"

Gives you a field with the name "response_code" with the specific value.

Let me know if it works and check out this great site
https://regex101.com

Regards,
pyro_wood

PS:.... god damn.... somesoni at it again, stealin my karma 😄

[somesoni2 · Accepted solution]

Try this

your base search | rex "\"responseCode\":\"(?<response_code>\d+)"

Based on the same data, it seems your data may be json format and you can get the fields extracted automatically (or you can set that up). Is it a proper json?