Regex formating help

[AHEARNJ]

Can anyone help me format a regular expression for Splunk?
I can create the regular expression using regexr.com and I have 2 non-capturing groups and a capturing group, but I am not sure how to format the regular expression for splunk.
Any tips or help you can provide is appreciated.

Here is my string:
string1="First Name (DEPT-User) account provisioned"
And the regex:
(:?string1=")([A-Za-z0-9() -]+)(:?account provisioned")
Thanks,

[niketn · Accepted solution]

Does your data contain string1="First Name (DEPT-User) account provisioned"? Ideally Splunk should have automatically identified this as key value pair during search time. Which implies you would need to create field extraction/rex on string1. Have you checked Interesting Fields in Verbose mode whether string1 field is already available or not? Which is the field you want to extract?

If you want to extract First Name (DEPT-User), following rex should work:

<YourBaseSearch> 
| rex field=_raw "string1=\"(?<Data>[^\)]+\)) account provisioned\""

[niketn]

@AHEARNJ, I have converted comment to answer. Please accept to mark as answered!