@ITWhisperer , the mistake I was doing is using | rex field=properties, your command worked for the actual data too. Thanks @ITWhisperer  ... View more

@ITWhisperer , Oh, you meant more than regex101, still unable to get results with 5 slashes. Am I missing something when translating the command from makeresults example to the actual data(any formatting stuff)? ... View more

@ITWhisperer , just checked on regex101.com, the rex with three slashes works for the raw data i shared   the rex string i gave in regex101.com is  /allowedSourceAddressPrefix\\\":\\\"(?<allowedSourceAddressPrefix>.*?)\\\"/gm   for the raw data i shared and it was able to match and get the desired value. ... View more

Thanks @ITWhisperer , but seems like I'm missing something to apply this when trying on actual data. The rex you've shared is working on makeresults(testing pattern). Can you pls correct me?   I'm trying this command index=test_ms* "operationName.localizedValue"="Initiate JIT Network Access Policy" "eventName.localizedValue"="JIT network access request initiate started" | rex field=properties "allowedSourceAddressPrefix\\\":\\\"(?<allowedSourceAddressPrefix>.*?)\\\"" | table allowedSourceAddressPrefix   And here's a sample data entry (actual raw data) { "channels": "Operation", "eventName": { "value": "JIT network access request initiate started", "localizedValue": "JIT network access request initiate started" }, "eventSource": { "value": "Security", "localizedValue": "Security" }, "id": "/subscriptions/3483b2ca-02cf-4ff6-92af-99326c8fac7f/resourceGroups/apple-dev/providers/Microsoft.Compute/virtualMachines/gjappledev/events/04xxxxab-5ecc-46b0-abfa-6aacb1f550ac/ticks/63783455299xxxxxx3", "level": "Informational", "resourceGroupName": "apple-dev", "resourceProviderName": { "value": "Microsoft.Compute", "localizedValue": "Microsoft.Compute" }, "resourceUri": "/subscriptions/3483b2ca-02cf-4ff6-92af-99326c8fac7f/resourceGroups/apple-dev/providers/Microsoft.Compute/virtualMachines/gjappledev", "operationName": { "value": "Microsoft.Security/locations/jitNetworkAccessPolicies/initiate/action", "localizedValue": "Initiate JIT Network Access Policy" }, "properties": { "User": "johndoe@contoso.com", "/subscriptions/3483b2ca-02cf-4ff6-92af-99326c8fac7f/resourceGroups/apple-dev/providers/Microsoft.Compute/virtualMachines/gjappledev": "{\"id\":\"/subscriptions/3483b2ca-02cf-4ff6-92af-99326c8fac7f/resourceGroups/apple-dev/providers/Microsoft.Compute/virtualMachines/gjappledev\",\"ports\":[{\"number\":3389,\"allowedSourceAddressPrefix\":\"*\",\"endTimeUtc\":\"2022-03-21T1:50:39.1599446Z\"}]}", "Justification": null }, "status": { "value": "Accepted", "localizedValue": "Accepted" }, "subStatus": { "value": null }, "eventTimestamp": "2022-03-21T1:50:39.1599446Z", "submissionTimestamp": "2022-03-21T1:50:39.1599446Z", "subscriptionId": "3483b2ca-02cf-4ff6-92af-99326c8fac7f" }   Thanks Again ... View more