It would help to know what you've tried already.
Try this
| rex field=db_name "(?<key>[^:]+)"
Be sure to change "db_name" to name of the field containing the key:value. Don't use _raw or this won't work.
Hi @mark_groenveld,
you could try this regex
| rex ":\s+(?<your_field>[^:]+)"
that you can test at https://regex101.com/r/pj1bQO/1
Ciao.
Giuseppe
It would help to know what you've tried already.
Try this
| rex field=db_name "(?<key>[^:]+)"
Be sure to change "db_name" to name of the field containing the key:value. Don't use _raw or this won't work.
Thanks Rich for the solution.
Hi @mark_groenveld,
good for you, see next time!
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated by all the contributors 😉