topic Re: Extract fields from comma seperated list in All Apps and Add-ons

Extract fields from comma seperated list

jbesant — Mon, 28 Sep 2020 16:48:28 GMT

Hello, I've just started using Splunk and have managed to extract a few fields from my source to create graphs and a dashboard but I am struggling with the Regx for the following:

04/06/2014 10:30:34,OEL_REPLEN_EVENT,sys_proc op_replen_sequencer,"Product code 71104449, Master TM 81117517, Insert TM 41030090, Quantity 4, Reason OTHER STOCK IN TRAY "

I am trying to extract the information in the message that is between the quotes,i.e. Product Code, Master TM, Reason

There are several different Reason which could be made up of anything between 2 and 4 words. In some cases there will be blank entries after Insert TM.

Hope someone can help! Thanks.

Re: Extract fields from comma seperated list

martin_mueller — Fri, 06 Jun 2014 05:33:00 GMT

If that's the first occurrence of double quotes you can use this regex:

,"(?<quoted_field_name>[^"]+)"

Re: Extract fields from comma seperated list

jbesant — Fri, 06 Jun 2014 12:55:22 GMT

Many thanks that was what I needed. I entered:

(?i) Reason (?P[^"]+)

this and it pulled out all the Reason phrases