Splunk Regex Field Extractions

[franciscoz1]

When writing regex, where in the regex string am I supposed to add the (?<new_field>) string ?

I have included a sample regex string below, where in this string would I add (?<new_field>) ?

(?<=\:\[)(.*)(?=\])

Thanks !

[franciscoz1]

Worked like a charm, thank you !

[bowesmana · Accepted solution]

If that is the exact regex and you are talking about using the rex command, then 

| rex "(?<new_field>(?<=\:\[)(.*)(?=\]))"

will extract the data between the [] into new_field