Splunk Regular Expression

[AHEARNJ]

I am trying to extract a filed using. | rex field=_raw
I used regexr to create a regular expression with an exclude group and a capture group.
I have this working, but can't seem to format this for Splunk.
Any good tips for Regex and Splunk?
Regex I am using:

 (?:<entry key="applications" value=")([a-zA-Z0-9 ]+)(?:"\/>)

String extracting the value from:

<entry key="applications" value="AD Users"/>

Any help you can provide is greatly appreciated.

Thanks,

[richgalloway]

Your regex string doesn't contain field extractions so the rex command is not doing anything for you. Another factor is the rex command requires quotation marks be escaped. See if this helps you.

... | rex "<entry key=\"applications\" value=\"(?<appValue>[a-zA-Z0-9 ]+)\"\/>" | ...