Need help in extraction

[srinivas_gowda]

Hello all,

I am tryin to extract only the highlighted from the below event, however I am failing to extract.

Can you please let me know here.

"Error","","/Example/JP1/NTEVENT_LOGTRAP/Oracle.persona","LOGFILE","NTEVENTLOG","LOGFILE","NTEVENTLOG","","","","","",9,"A0","1630500097","A1","PSD067","A2","Application","A3","Error","A4","None","A5","20","A6","N/A"

"Error","","/Example/JP1/NTEVENT_LOGTRAP/Microsoft-Windows-Kerberos-Key-Distribution-Center","LOGFILE","NTEVENTLOG","LOGFILE","NTEVENTLOG"

Thank you

[ITWhisperer · Accepted solution]

| rex "\/Example(?<resource>[^\"]+)"

[ashvinpandey]

@srinivas_gowda Use the below command in your search query

| regex field=_raw "Example(?<resource>.*?)\""

Also, If this reply helps you, an upvote would be appreciated.