Unable to view the field created using rex

[prabu_harsh12]

string used in the search rex "(?i) Message= (?P[^.]+)"

Event log form where im trying to extract "Message=The Windows Management Instrumentation service entered the running state"

[neelamssantosh]

For better/future reference,
Use Interactive Field Extractor
http://www.splunk.com/view/SP-CAAADUY

Splunk, makes life's easy :).

[richgalloway · Accepted solution]

Be careful of extra spaces in your rex string. Also, the '(?i)' is unnecessary.

[prabu_harsh12]

It worked after removing the extra space. thanks so much! Wish you a happy new year!