If you want to extract all guids after "fieldx":   | rex max_match=0 "(\'fieldx\':\s)?(?<fieldx_guids>\w{8}\-\w{4}-\w{4}-\w{4}-\w{12})(?:\,\s|\")"     If you want to extract all guids in the data:     | rex max_match=0 "(?<guids>\w{8}\-\w{4}-\w{4}-\w{4}-\w{12})"     ... View more

@ITWhisperer  thatll make the search look better for sure. Thanks! ... View more