title: Splunk field extraction with square brackets [ ]
body: <p>I'm trying to parse the below sample using Delimiters, could anyone help with the extraction. Delimiters don't seem to work for this. Can someone help with Regex commands?</p>
  <p><code>[2021-05-07T20:54:50.6222+10:00] [BDF] [ERROR:32] [BD99999] [security2] [client_id: 10.10.18.236] [host_id: google.com ] [host_addr: 10.10.05.11] [pid: 5397] [tid: 139783720359680] [user: apaapp] [ecid: 005kRh1ly^x8dpK_yTk3yW0001K80002jb] [rid: 0] [VirtualHost: google:4445] [client 0.10.18.236] ModSecurity: Warning. Pattern match &quot;^[\\\\d.:]+$&quot; at REQUEST_HEADERS:Host. [file &quot;/apps/vbgrt/bdf/Google/Middleware/user_projects/domains/bdf_domain/config/fmwconfig/components/BDF/instances/bcp/crs-rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;735&quot;] [id &quot;920350&quot;] [msg &quot;Host header is a numeric IP address&quot;] [data&quot;10.10.05.11:4445&quot;] [severity &quot;WARNING&quot;] [ver &quot;OWASP_PQR/3.3.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;paranoia-level/1&quot;] [tag &quot;OWASP_PQR&quot;] [tag &quot;capec/1000/210/272&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;google&quot;] [uri &quot;/&quot;] [unique_id &quot;HTjues090uwmX0Cz1kLVwAAAIw&quot;]</code></p>