Event Rule Regex

[Jyoti33]

In Event Rule, I'm trying to fetch the CI from hostname of additional info field.
field is - 

[{deviceDetails={type=ertyryt Unified Access Point, family=Unified AP, inventoryStatusDetail=NA, series=Cisco Catalyst 9120AXI Series Unified Access Points, macAddress=sgfdg, hostname=OPP001-04MAP04, upTime=10 days, 34245436546, errorDescription=null, bootDateTime=null, collectionStatus=Unassociated, managementIpAddress=2342433, memorySize=NA, platformId=3534543, reachabilityFailureReason=NA, reachabilityStatus=Unreachable, collectionInterval=NA, lastUpdated=2023-34546456, serialNumber=sdgdrgtrdy, softwareVersion=r6756756, id=567567567567567567, neighborTopology=[], cisce55drto360view=https:/5675675677}}"

Regex is - hostname=([^\s,]+)

IF I'm testing from regex101 its working fine but giving <<UNKNOWN>> value using event rule.
hostname can be like OPP001-04MAP04 or OPQQ001-040UDS01.corp.xyzabc.org

[Pratiksha]

Are you getting unknown value in on the alert ? Perhaps  the binding is not working. 

[Sam Webb]

ServiceNow's Event Regex isn't always consistent, let's say. Have you tried a field mapping to populate $node?

Before you try that - it might be interesting to see what happens if you clear out $node and let the search logic do its thing (though that's more curiosity than a recommendation)!

Thanks,

Sam