"Context":"{"user id":"jane.doe.sen", "Expense Date":"11/10/2022",
How to use extract this rex command?
to come up result like
user id | Expense Date |
jane.doe.sen | 9/6/2022 |
please help
Assuming the field is as written and is in the _raw field
| rex "user id\":\"(?<user_id>[^\"]*)\",\s+\"Expense Date\":\"(?<expense_date>[^\"]*)"