topic Re: I have a problem in creating regex for below expression? in Splunk Search

I have a problem in creating regex for below expression?

pal_sumit1 — Tue, 08 May 2018 16:30:31 GMT

expression:
2018-02-2008:13:44|ABC1034|Sumit Martin|0|147707|Amit|SURESH||19490616|M|2030 SQ 16 PERRA|ABC E-212|INDIA|FL|33125|7863174200|Tiger|Transportation|Created|

I have created regex for extracting threefields but not able figure out how to write for other fields.You can assign any name for fields.
Below is my regex:
(?timestamp(\d{4})-(\d{2})-(\d{4}):(\d{2}):(\d{2}))|(?id([A-Z]{3}\d{4}))|(?contact(\d{10}))

After the ? ,there is < timestamp and after field name >. Splunk editor is not allowing me to add that .eg:- < timestamp ">"
Don't keep double quotes.

Thanks.

Re: I have a problem in creating regex for below expression?

somesoni2 — Tue, 08 May 2018 16:47:04 GMT

Try this (they pipe separated values so regex doing the same, dummy field names are used here, update per your data and it's sequencing in the data)

###props.conf on Search Head
[yourSourceType]
EXTRACT-fields = ^(?<Timestamp>[^\|]+)\|(?<field1>[^\|]+)\|(?<field2>[^\|]+)\|(?<field3>[^\|]+)\|(?<field4>[^\|]+)\|(?<field5>[^\|]+)\|(?<field5>[^\|]+)\|(?<field1>[^\|]+)\|(?<field1>[^\|]+)\|(?<Timestamp>[^\|]+)\|(?<field1>[^\|]+)\|(?<field1>[^\|]+)\|(?<field1>[^\|]+)\|(?<field1>[^\|]+)\|(?<field1>[^\|]+)\|(?<field1>[^\|]+)\|(?<field1>[^\|]+)\|(?<field1>[^\|]+)\|

OR (props.conf and transforms.conf on Search Head)

###props.conf on Search Head
[yourSourceType]
REPORT-fields = psv_fields_for_yourSourceType

###transforms.conf on Search head
[psv_fields_for_yourSourceType]
DELIMS = "|"
FIELDS = "timestamp", "field1", "field2",...comma separated list of all fields..

Re: I have a problem in creating regex for below expression?

jodyfsu — Tue, 08 May 2018 16:47:48 GMT

Hello, could you provide a sample event?

Re: I have a problem in creating regex for below expression?

somesoni2 — Tue, 08 May 2018 16:47:48 GMT

If you want to extract the field inline in the search, the regular expression from first option (EXTRACT-fields) in your rex command.