Attempt A index="w3c" | rex field=_raw "?(sessionid=?)\w{8}-\w{4}-\w{4}-\w{4}-\w{12}" | table ABC _raw
Attempt B index="w3c" | rex field=_raw "\.\sessionid\=\"(?P)[\w{8}]-[\w{4}]-[\w{4}]-[\w{4}]-[\w{12}]" | table ABC _raw
Attempt C index="w3c" | rex field=_raw "\.\sessionid\=\"(?P[\w{8}]-[\w{4}]-[\w{4}]-[\w{4}]-[\w{12}])" | table ABC _raw
(I used a named field ABC, it gets cut from this post)
FROM text:
.sessionid=d2a4f0de-747f-413c-a823-03ee7d241d5b&hash
The GOAL:
ABC = d2a4f0de-747f-413c-a823-03ee7d241d5b
... View more