title: Splunk: How to extract field directly in Search command using regular expressions?
body: <p>I have some log files which looks like this one:</p>
  <p><em>2020-11-18 00:11:22.333  INFO [ABC_service,[{&quot;method&quot;:&quot;doSomething&quot;,&quot;id&quot;:&quot;123456789&quot;,&quot;jsonrpc&quot;:&quot;2.0&quot;,&quot;params&quot;:{&quot;taskType&quot;:&quot;certainType&quot;,&quot;clientNotificationInfo&quot;:{&quot;priority&quot;:xy,&quot;expirationDate&quot;:111111111},&quot;priority&quot;:xy,&quot;deviceId&quot;:&quot;000000000000000&quot;,&quot;taskPayload&quot;:{},&quot;timeout&quot;:22222222}}, XYZ]</em></p>
  <p>I now would like to extract fields directly in my search and make a table of the extracted values. I would like to extract the taskType, here: <em>certainType</em>. Now, I was wondering about how to do this.</p>
  <p>I tried this command:</p>
  <pre><code>source=&quot;/log/ABCDE/ABCDE_service.log&quot; doSomething | rex field=_raw &quot;taskType: (?&lt;taskType&gt;.*)&quot;    | table  taskType
  </code></pre>
  <p>But got an empty table. What is wrong here?</p>
  <p>But I got an empty table for both values.</p>