topic Re: Multiple fields extraction in Getting Data In

Multiple fields extraction

prakashraja1999 — Wed, 08 Sep 2021 15:21:30 GMT

Re: Multiple fields extraction

richgalloway — Wed, 08 Sep 2021 14:35:16 GMT

Here are two ideas: rex command and extract command.

Re: Multiple fields extraction

prakashraja1999 — Wed, 08 Sep 2021 14:46:23 GMT

Kindly share the rex and extract commands

Re: Multiple fields extraction

ITWhisperer — Wed, 08 Sep 2021 14:59:15 GMT

| rex max_match=0 "(?<name>\w+):(?<value>.+?)(?=\s+\w+:|$)"

Re: Multiple fields extraction

richgalloway — Wed, 08 Sep 2021 15:04:50 GMT

The question asked for ideas, not for someone else to do the work. 😀 Did you at least look at the commands?

@ITWhisperer has shown the rex command. Here is extract:

| extract pairdelim=" " kvdelim=":"

Re: Multiple fields extraction

ITWhisperer — Wed, 08 Sep 2021 15:57:39 GMT

This gives you two multi-value fields for the names and the values - if you want corresponding fields created for these, you could do something like this

| rex max_match=0 "(?<_name>\w+):(?<_value>.+?)(?=\s+\w+:|$)" | streamstats count as _event | eval index=mvrange(0,mvcount(_name)) | mvexpand index | eval _name=mvindex(_name,index) | eval _value=mvindex(_value,index) | eval {_name}=_value | fields - _name _value index | stats values(*) as * by _event | fields - _event

Note that extract might not work depending on the consistency of pair delimiters and their inclusion in the value strings.