topic Create new Key-Value-Pair out of a Value in Getting Data In

Create new Key-Value-Pair out of a Value

Dreads94 — Thu, 12 Dec 2013 08:30:24 GMT

Hey together,

I've got a problem with extracting multiple key-value-pairs.
At the moment my input looks like this:

PrcTpMem=firefox.exe=1611500, eclipse.exe=1393504, javaw.exe=1180432.

When I extract the fields, it looks like PrcTpMem ist the Key for "firefox.exe=1611500".
The following pair is eclipse.exe=1393504 caused by the comma.
Actually the last way is the way it should look like.
But I've got no idea how to split the first part or how to cut the first part by leaving out "the PrcTpMem=".

In addition I have to manage it by editing the transforms.conf.

The Transforms.conf for this part looks like this at the moment :

[System_Healthy]

DELIMS = ";", ",="

It would be great if someone of you had an idea. Thanks!

Re: Create new Key-Value-Pair out of a Value

jtrucks — Fri, 13 Dec 2013 21:43:23 GMT

Setting up an extract like:

PrcTpMem=firefox.exe=(?<firefox>\d+),\seclipse.exe=(?<eclipse>\d+),\sjavaw.exe=(?<java>\d+)

will pull these out.

However, if the items after PrcTpMem= can be dynamic or numerous, and if the PrcTpMem= string itself is useless to you, look at props.conf section for SEDCMD- to remove that string entirely, which would basically solve your problem immediately upon indexing the new data.

Re: Create new Key-Value-Pair out of a Value

Dreads94 — Tue, 17 Dec 2013 13:51:17 GMT

Thanks a lot! It worked great.