Having trouble with rex matching wildcards with escaped double quotes

[weropitjpoerit]

Hi there, I am having some trouble matching patterns from a search string using the rex command.

I will show the message I am trying to search on, as well as several rex statements that I am using to find and extract certain bits of data (denoted by asterisks) into fields that I use in a table statement. rex statements matching wildcards populated by digits works fine, but I'm not able to match and extract data matching asterisks when they  are within quotes even if I escape them.

| search Message="Error in breakfast table *, table name \"*\". The quick brown fox jumped over the lazy dog. The maximum length of the \"*\" data is currently set to * hotdogs, but the bun length is * inches. Increase the maximum length of the \"*\" bun to at least * inches and retry.*"
| rex "Error in breakfast table (?<breakfast_table>\d+)" | rename breakfast_table as "BT"

| rex "table name \"(?<table_name>[^\"]*)\"" | rename table_name as "TN"
| rex "maximum length of the \"(?<max_bunlength>[^\"]*)\"" | rename max_bunlength as "MB"

| rex "data is currently set to (?<current_length>\d+)" | rename current_length as "Current Length"

I am able to pattern match correctly on asterisks because they just represent number values. I am having trouble with asterisks within double quotes. For example, a real message may show "AB" or "Z" but this line will not match it, even though I have confirmed on regex101 that it should be matching the letters AB or Z correctly -> | rex "table name \"(?<table_name>[^\"]*)\"" | rename table_name as "TN"

Any suggestions on this?

[richgalloway]

To help with rex questions we really need to see example data.  Please share sanitized events.

[weropitjpoerit · Accepted solution]

I can't share the _raw event I used but I can mention how I was able to solve this issue.

I went through the Extract New Fields process, highlighted the bit of information I needed like so -> \"author\", viewed the generated regex, opened it in search so I could see the full |rex command that was generated, and used that.