Can someone please help me in extracting the field Specific_DL_Testing from the below sample log.
instance of the "\Specific_DL_Testing" task.
The output should be Specific_DL_Testing
I have used the above expression but its not extracting the field.
Here is a runanywhere example of it working
| makeresults
| eval _raw="instance of the \"\\Specific_DL_Testing\" task."
| rex "instance of the \"\\\(?<task>[^\"]+)\" task."
If it is not working for you, please provide example events and the SPL you are using (preferably in code blocks </> like the example above to prevent information being lost due to formatting
Task Scheduler terminated "{8878FDRGSGS-8cde-1234-123456789}" instance of the "\Specific_DL_Testing" task.
Please try on this event
| makeresults
| eval _raw="Task Scheduler terminated \"{8878FDRGSGS-8cde-1234-123456789}\" instance of the \"\\Specific_DL_Testing\" task."
| rex "instance of the \"\\\(?<task>[^\"]+)\" task."
I see you are checking for "\\Specific_DL_Testing\"
Can you try for "\Specific_DL_Testing\"
I am not checking for "\\Specific_DL_Testing\" - this is part of the eval command to create the sample _raw field in line with what you say is your event
As you can see from the _raw field in the screenshot, the event matches what you said you event was.
Getting error :- Error in 'rex' command: Encountered the following error while compiling the regex '\instance of the "\(?<task>[^"]+)" task.': Regex: unrecognized character follows \.
I missed a backslash
| rex "instance of the \"\\\(?<task>[^\"]+)\" task."
| rex "instance of the \"\\(?<task>[^\"]+)\" task."