What is the regular expression to extract the field from my raw event?

[kiran331]

Hi

How to extract the bolded field below from my raw event. It will the anything after msg=(Action: Connect). Any suggestions?

30 11:39:33 CEF:0|Cyber-Ark|Vault|9.70.0020|308|Use Password|5|act=Use Password suser= fname= dvc=1shost=111.22.0.3 dhost=1123 duser= externalId= app= reason= cs1Label="Affected User Name" cs1= cs2Label="Safe Name" cs2=PSMUnmanagedSessionAccounts cs3Label="Device Type" cs3=PSM Secure Connect cs4Label="Database" cs4= cs5Label="Other info" cs5=111.12.13 cn1Label="Request Id" cn1= cn2Label="Ticket Id" cn2=(Action: Connect)INC1134557- Patching for Systems msg=(Action: Connect)INC1134557- Patching for Systems

[GersonGarcia]

rex field=_raw "msg=\(Action: Connect\)(?P< mymsg >.*)"

There is no spaces between < and mymsg and >

[kiran331]

I got this Error.

Error in 'rex' command: Encountered the following error while compiling the regex 'msg=(Action: Connect)(?P< mymsg >.*)': Regex: letter or underscore expected after (?< or (?'

[GersonGarcia]

Kiran,
You need to remove the spaces after < and before > it is some format issue in the post.