Answer by warren for (Splunk) How can I use the rex command to pattern match wildcards enclosed by double quotes?

These rex commands should work:

| rex field=Message "rror in \w+\s\w+\s(?<error>[^,]+)"
| rex field=Message ", table name\s[^\"]+(?<table_name>[^,]+?)\"\."
| rex field=Message "The maximum[^\"]+\"(?<max_bun_length>[^\"]+)"
| rex field=Message "data is currently set to (?<current_length>\S+)"

from User warren – Stack Overflow https://stackoverflow.com/questions/76066710/splunk-how-can-i-use-the-rex-command-to-pattern-match-wildcards-enclosed-by-do/76082391#76082391
via IFTTT