regex extracting between xml tags and quotes

[exocore123]

<fin:Data namespace=\"url1\" type=\"EData\">...

Using
basic search | rex "Data\snamespace=\"(?P<preName>[^\"]+)\"" | stats count by preName is empty

Error here
basic search | rex "Data\snamespace=\\\"(?P<preName>[^\\]+)\\\"" | stats count by preName

I am not sure what's wrong, no results found. I am trying to get url1 using the regex above, but it's not matching? I am trying to see the list of values for that particular tag

[woodcock]

You need this:

| makeresults | eval _raw="...
...<fin:Data namespace=\\\"url1\\\" type=\\\"EData\\\">..."
| rex "Data\snamespace=\\\\\"(?<preName>[^\\\"]+)\\\\\""

[somesoni2 · Accepted solution]

Try like this

basic search | rex "Data\snamespace=[^\"]+\"(?P<preName>[^\"]+)\"" | stats count by preName

[exocore123]

Care to explain? I also still have "\" at the end, are we just matching until we see quotations?

[somesoni2]

That's correct. after namespace= match till next double quotes (avoiding escaped backward slash altogether). Rest is same as your's.