please help me to extract the quoted word
abcd > efgh > "lmn pqr"
I tried with “(?[^>]$)" but while querying like this
|rex field=_raw “word (?[^>]$)" showing error.
Thanks in advance
I noticed the quotes in your regex are two different characters, the first pair do not match the text. Here is a suggestion that closely matches your regex:
without a named field---> |rex field=_raw "\"(.+[^>])\"$"
with a named field ---> |rex field=_raw "\"(?<FieldName>.+[^>])\"$"
Hi @deeptha1992,
Try this :
|rex field=_raw “([^>]+[>])+\s?\"(?<YourFieldName>.+)\"$"
Cheers,
David