please help me to extract the quoted word
abcd > efgh > "lmn pqr"
I tried with  “(?[^>]$)"   but while querying like this
 |rex field=_raw “word (?[^>]$)"   showing error.
Thanks in advance
 
					
				
		
I noticed the quotes in your regex are two different characters, the first pair do not match the text. Here is a suggestion that closely matches your regex:
without a named field--->       |rex field=_raw "\"(.+[^>])\"$"
with a named field --->         |rex field=_raw "\"(?<FieldName>.+[^>])\"$"
 
					
				
		
Hi @deeptha1992,
Try this :
|rex field=_raw “([^>]+[>])+\s?\"(?<YourFieldName>.+)\"$"
Cheers,
David 
