how to extract string started with different words

[Laya123]

Hi,

I have logs like I want to extract the Bold string from the below logs.

I used below rex but it's showing no results. can anyone help me to resolve this

| rex field=_raw "[A-Z]/(?.*) - 80 OR - 443"

2017-03-29 12:25:32 W3SVC2 172.30.2.174 GET /API/BrandsForCategoryReport/BrandsByList/FIBA/RU-RU/201714 - 80

2017-03-29 11:10:52 W3SVC2 172.30.2.174 GET /API/Local/Attribute/HI-IN-DL/FICA/GTS/_13237/upos2_stmt - 80 KT\chaudharis 10.116.164.62 HTTP/1.1 Mozilla/4.0+

2017-03-29 10:45:21 W3SVC2 172.30.2.174 POST /GUI/Local/StoreName/Update/EN-IN-DL/FIBS/GTS/_24978-03/so3_list - 80 KT\YadavKo

2017-03-29 12:19:20 W3SVC2 172.30.2.174 GET /GUI/Scripts/jquery-1.4.1.min.js - 80 KT\apten

2017-03-29 12:19:20 W3SVC2 172.30.2.174 GET /GUI/Scripts/qdb.edit-global-content.js - 80 KT\apten

2017-03-29 11:36:16 W3SVC2 172.30.2.174 GET /WUI/Content/lib/kendo/2016.2.714/css/Bootstrap/sprite.png - 443 KT\apten

2017-03-29 11:36:15 W3SVC2 172.30.2.174 GET /WUI/Content/lib/kendo/2016.2.714/css/Bootstrap/loading-image.gif - 443 KT\apten

2017-03-29 11:31:58 W3SVC2 172.30.2.174 GET /WUI/Content/lib/fontawesome/fonts/fontawesome-webfont.woff2 v=4.6.3 443 KT\HuynhH

2017-03-29 11:43:45 W3SVC2 172.30.2.174 PUT /WAPI/v4/translations/attribute/surveys/BGS/countries/IN/languages/HI/publish - 443 kt\apten

2017-03-29 11:18:37 W3SVC2 172.30.2.174 GET /WAPI/v4/translations/attribute/surveys/BGS/lists/upos2_stmt/countries/IN weekInterval.on=201713&weekInterval.off=201813 443 kt\apten

Thanks in advance

[alemarzu · Accepted solution]

Hi there, try something like this,

(?:GET|POST|PUT)\s\/[\w]+\/(?<FIELD_NAME>[^\s]+)\s

[Laya123]

Thank you so much its working

[alemarzu]

Nice, happy Splunking!