oh one more thing, the content between "=" and "request" could be any number of character or number and can have multiple spaces as well ... View more

@richgalloway  the text trying to match here is anything after "=", until "request" so the complete text here is  message=abc ef x request-id ... View more

Hello @richgalloway  Thank you for taking the time and explaining. I really appreciate the time you vested in explaining this. Interestingly this one works      | rex field=_raw message="(?<message>.*).request"   So does the    | rex field=_raw "message="(?<message>.*).request""   but not the    "message=\\\"(?<message>.*).request\\\""   when I say work, I mean it is giving the desired result and by not working I mean not giving the desired result. Although in none of the cases there wasn't any syntax error. The one with the escaped quotation mark only gives the result until before the spaces i.e. if it is "message=abc efg request-id", it only prints "abc". Does this have anything to do with the Splunk version? 2. Regarding The sequence .* ("dot-star") means "everything from here on"  - I am assuming this regex and nothing to do with Splunk itself. So I tried to use this concept in a sublime text editor to see what happens. I used    message=Error translating Grubhub webhook order: The location for this order cannot be found request-id   and tried to replace message=.* with let's say new. I found the entire thing got wiped out and replaced with new. I was expecting something like message=new. I even tried message="(?.*).request", "message="(?.*).request"", but no changes happened. Is it because Splunk uses some different regex logic than sublime text editor? 3. I am still confused about the use of quotation mark, I tried using the website which you mentioned, but it confused me more lol.  ... View more

Hi @to4kawa can you please explain a bit more when you say the query is wrong? What I meant above is in the complete query I am not using search instead using where service | where not reason like "%P%" |table status, reason ... View more

I am only using where but still the same ... View more

Hello @to4kawa It is still giving me values "X" and "Y" ... View more

Hi @richgalloway the raw data is like service: mnp, o=123, X1=[A(status=X, reason=Y), A(status=Z, reason=Y), A(status=xyz, reason=abc)] and my <search criteria> is service ... View more

Hello @gcusello Thank you. I think i can use this ... View more

Hello @gcusello Can you help me with the syntax if i want to use date_wday and date_hour ... View more

It seems the splunk integration was broken because I did not include some text in the message section. All sorted and thanks for your help ... View more

although I am using earliest but i still changed the time range from alert configuration to 2 mins (earlier it was 12 hours) still no luck ... View more