$re = '/Actual\s+value\":\s+\"(?<actual_value>[^\"]+)\"/m';
$str = 'LogName=LoginPI Events EventCode=1300 EventType=4 ComputerName=RNBSVSIMGT02.rightnetworks.com SourceName=Login Threshold Exceeded Type=Information RecordNumber=285782 Keywords=Classic TaskCategory=None OpCode=Info Message={ "Description": "Total login time (48s) exceeded threshold of 45s (6.67%)", "Actual value": "48", "Threshold value": "45", "AccountId": "4c06e54e-ab5f-47a6-2cc7-08d807c9fae2", "AccountName": "rightnetworks\\\\eloginpi049", "LauncherName": "RNBSVSI21", "Locale": "English (United States)", "RemotingProtocol": "Rdp", "Resolution": "1920 × 1080", "ScaleFactor": "100%", "TargetHost": "BPSQCP00S143", "TargetOS": "Microsoft Windows Server 2016 Standard 10.0.14393 (1607)", "EnvironmentName": "BPSQCP00S143", "EnvironmentId": "06a3c4a2-6f73-4c54-94e9-08d8040960f8", "Title": "Login time threshold exceeded"';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php