Regex- Help with extracting field

[Dayalss]

Can someone please help me in extracting the field Specific_DL_Testing from the below sample log.

instance of the "\Specific_DL_Testing" task.

The output should be Specific_DL_Testing

[Dayalss]

I have used the above expression but its not extracting the field.

[ITWhisperer]

Here is a runanywhere example of it working

| makeresults 
| eval _raw="instance of the \"\\Specific_DL_Testing\" task." 
| rex "instance of the \"\\\(?<task>[^\"]+)\" task."

If it is not working for you, please provide example events and the SPL you are using (preferably in code blocks </> like the example above to prevent information being lost due to formatting

[Dayalss]

Task Scheduler terminated "{8878FDRGSGS-8cde-1234-123456789}" instance of the "\Specific_DL_Testing" task.

Please try on this event

[ITWhisperer]

| makeresults 
| eval _raw="Task Scheduler terminated \"{8878FDRGSGS-8cde-1234-123456789}\" instance of the \"\\Specific_DL_Testing\" task." 
| rex "instance of the \"\\\(?<task>[^\"]+)\" task."

[Dayalss]

 I see you are checking for "\\Specific_DL_Testing\"

 Can you try for "\Specific_DL_Testing\" 

[ITWhisperer]

I am not checking for "\\Specific_DL_Testing\" - this is part of the eval command to create the sample _raw field in line with what you say is your event

ITWhisperer_0-1679565726287.png

As you can see from the _raw field in the screenshot, the event matches what you said you event was.

[Dayalss]

Getting error :- Error in 'rex' command: Encountered the following error while compiling the regex '\instance of the "\(?<task>[^"]+)" task.': Regex: unrecognized character follows \.

[ITWhisperer]

I missed a backslash

| rex "instance of the \"\\\(?<task>[^\"]+)\" task."

[ITWhisperer]

| rex "instance of the \"\\(?<task>[^\"]+)\" task."