REGEX problem

[splunklearner]

Please help me in extracting only compression values from this raw event - 

"response_time_last_byte":5,"compression_percentage":0,"compression":"NO_COMPRESSION_CAN_BE_COMPRESSED","client_insights":"","request_headers":577,"response_headers":13,"request_state":"AVI_HTTP_REQUEST_STATE_SEND_RESPONSE_BODY_TO_CLIENT",

"response_time_last_byte":1,"compression_percentage":0,"compression":"","client_insights":"","request_headers":3,"response_headers":12,"request_state":"AVI_HTTP_REQUEST_STATE_READ_CLIENT_REQ_HDR",

Tried this but it is extracting client insights as well. I need to exclude all compression string values by writing SEDCMD 

splunklearner_0-1739949982232.png

[livehybrid · Accepted solution]

 Hi @splunklearner 

Try using the following REGEX 

\"compression\":\"([^\"]*)\"\,

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will