Hi there, I am having some trouble matching patterns from a search string using the rex command. I will show the message I am trying to search on, as well as several rex statements that I am using to find and extract certain bits of data (denoted by asterisks) into fields that I use in a table statement. rex statements matching wildcards populated by digits works fine, but I'm not able to match and extract data matching asterisks when they are within quotes even if I escape them. | search Message="Error in breakfast table *, table name \"*\". The quick brown fox jumped over the lazy dog. The maximum length of the \"*\" data is currently set to * hotdogs, but the bun length is * inches. Increase the maximum length of the \"*\" bun to at least * inches and retry.*" | rex "Error in breakfast table (?<breakfast_table>\d+)" | rename breakfast_table as "BT" | rex "table name \"(?<table_name>[^\"]*)\"" | rename table_name as "TN" | rex "maximum length of the \"(?<max_bunlength>[^\"]*)\"" | rename max_bunlength as "MB" | rex "data is currently set to (?<current_length>\d+)" | rename current_length as "Current Length" I am able to pattern match correctly on asterisks because they just represent number values. I am having trouble with asterisks within double quotes. For example, a real message may show "AB" or "Z" but this line will not match it, even though I have confirmed on regex101 that it should be matching the letters AB or Z correctly -> | rex "table name \"(?<table_name>[^\"]*)\"" | rename table_name as "TN" Any suggestions on this?
... View more