Regular expression to extract http status

[thenormalone]

I have http statuses that come in from 2 different indexes, with almost the same event but the event from one indexer has a combination of space and comma as a delimiter and other just has spaces. 

How do I split the event from the search string such that I get the status from both indexes. I have 

| rex field=_raw "^(?:[^\s]*\s){8}(?P<statusCode>\d+)"  

but this only check for space, I need to also include comma as a delimiter too

[ITWhisperer]

Do you have examples of the two types of logs that you can share?

[thenormalone]

example from indexer 1: 

172.22.83.162 - - [10/Jul/2018:14:46:42 +0000] "GET /tests/benefits HTTP/1.1" 200 337 "-" "Ruby" 0

example from indexer 2: 

172.22.83.162 - - [10/Jul/2018:14:46:42,+0000] "GET /tests/benefits HTTP/1.1" 200 337 "-" "Ruby" 0

The timestamp has a comma instead of a space

[ITWhisperer · Accepted solution]

| rex field=_raw "^(?:[^\"]*\"){2}\s(?P<statusCode>\d+)"