Struggling with rex

[splunkingsid]

Hoping to find a solution here for my rex query (new to rex)

I have an event that looks like this

time="2024-06-22T00:31:43.939620127Z" level=info msg="uuid="KENT-12345678-1234-1234-1234-123456789123", tkt=INC123456789, ci=SAP, state=Escalate, opened=2024-06-22 00:31:06, closed=0001-01-01 00:00:00 +0000 UTC, title=server123.corp: userTrap: 1 ABC Job: 927370523:ABC_0001_DEF_XX_GHIJK_XXXX2_MOSU:Killed"

How do I write a query that will extract this string "server123.corp: userTrap: 1 ABC Job: 927370523:ABC_0001_DEF_XX_GHIJK_XXXX2_MOSU:Killed"

Thank you very much

[yuanliu · Accepted solution]

Without other samples, I'd go with the most aggressive:

| rex "title=(?<title>[^\"]+)"