I'm trying to extract field That looks like below

[PavanSeerapu]

I'm trying to extract field That looks like "Alert-source-key":"[\"abcdd-gdfc-mb40-a801-e40fd9db481e\"]"

I have tried this "Alert-source-key":"(?P<Alert_key>[^"]+)" but i'm getting results like "[/" since it is checking for only 

[PavanSeerapu]

What exactly are you trying to extract from that string? -- abcdd-gdfc-mb40-a801-e40fd9db481e

I'm using field extractor through splunk web and writing the regular expression by myself

[isoutamo]

This seems to work

| makeresults 
| eval foo = "\"Alert-source-key\":\"[\\\"abcdd-gdfc-mb40-a801-e40fd9db481e\\\"]\"" 
| rex field=foo "\"Alert-source-key\":\"\[\\\\\"(?P<Alert_key>[^\"\\\]+)"

In this kind of cases there are needed "couple" of escapes \.

r. Ismo 

[richgalloway · Accepted solution]

This regex works in regex101.com and should also work in the Field Extractor.

Alert-source-key":"\[\\"(?<AlertSource>[^\\]+)

[richgalloway]

What exactly are you trying to extract from that string?  Where and how are you doing so?

If you're trying to extract the field using the rex command in a search then the embedded quotation marks must be escaped.