Incorrect Regex

[IRHM73]

Hi, I wonder whether someone may be able to help me please.

I've created this regex \"Surname\\":\\"(?<SName>[^"]+)\\" which extracts the Surname from the following raw data:

"Surname\":\"SMITH\"

This works fine in Regex101, but I when I add this to my query here:

auditSource=tamc auditType=OutboundCall | rex field=_raw "\"Surname\\":\\"(?<SName>[^"]+)\\""

I receive the following error:

Mismatched ']'.

I just wondered whether someone may be able to look at this please and let me know where I've gone wrong.

Many thanks and kind regards

Chris

[woodcock · Accepted solution]

Like this:

"Surname":"(?<SName>[^"]+)"

And this:

auditSource=tamc auditType=OutboundCall | rex field=_raw "\"Surname\":\"(?<SName>[^\"]+)\""

[IRHM73]

Hi @woodcock thank you for coming back to me with the solution.

Kind regards

Chris

[stephanefotso]

Hello try this: auditSource=tamc auditType=OutboundCall | rex field=_raw "\"Surname\":\"(?[^\"]+)\""

[IRHM73]

Hi thank you for coming back to me with this, but unfortunately I still receive the same error.

I'm able to get past the error using rex field=_raw "\"Surname\":\"(?[^\"]+)\"" but it is not extracting any information.

Kind Regards

Chris