https://community.splunk.com/t5/Splunk-Search/How-to-fetch-the-values-from-log-using-regular-expression/m-p/404483#M116991 <P>This worked thanks</P> Wed, 24 Jul 2019 22:44:24 GMT aqaadi 2019-07-24T22:44:24Z https://community.splunk.com/t5/Splunk-Search/How-to-fetch-the-values-from-log-using-regular-expression/m-p/404478#M116986 <P>Hi Team,</P> <P>Need your help on below search:</P> <P>I'm spitting something like this in the log:</P> <PRE><CODE>My Test Data|My Test ID|My Case Status|My verification code|My Comments on case The log has the data similar to above format delimited by pipe "|" </CODE></PRE> <P>I have around 8 fields in this way and I want to extract them in a table format and send the output to a service.</P> <P>Can you help me achieve it?</P> Tue, 23 Jul 2019 13:38:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fetch-the-values-from-log-using-regular-expression/m-p/404478#M116986 aqaadi 2019-07-23T13:38:51Z https://community.splunk.com/t5/Splunk-Search/How-to-fetch-the-values-from-log-using-regular-expression/m-p/404479#M116987 <P>Hi</P> <P>Try like</P> <PRE><CODE>| makeresults | eval test="aaa|bbb|ccc|ddd|eee" | eval result=split(test,"|") | eval My_Test_Data=mvindex(result,0),My_Test_ID=mvindex(result,1),My_Case_Status=mvindex(result,2),My_verification_code=mvindex(result,3),My_Comments_on_case=mvindex(result,4) | table My_Test_Data My_Test_ID My_Case_Status My_verification_code My_Comments_on_case </CODE></PRE> Tue, 23 Jul 2019 14:48:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fetch-the-values-from-log-using-regular-expression/m-p/404479#M116987 vnravikumar 2019-07-23T14:48:28Z https://community.splunk.com/t5/Splunk-Search/How-to-fetch-the-values-from-log-using-regular-expression/m-p/404480#M116988 <P>thanks let me try it.<BR /> How do i passs the log snippet at runtime to test variable?</P> Tue, 23 Jul 2019 16:12:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fetch-the-values-from-log-using-regular-expression/m-p/404480#M116988 aqaadi 2019-07-23T16:12:23Z https://community.splunk.com/t5/Splunk-Search/How-to-fetch-the-values-from-log-using-regular-expression/m-p/404481#M116989 <P>what should be the value of makeresults here ? </P> Tue, 23 Jul 2019 19:00:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fetch-the-values-from-log-using-regular-expression/m-p/404481#M116989 aqaadi 2019-07-23T19:00:14Z https://community.splunk.com/t5/Splunk-Search/How-to-fetch-the-values-from-log-using-regular-expression/m-p/404482#M116990 <P>I tried the regex expression <STRONG>regex _raw=(ML\D{17})|(\D{3}\d{6}-\d{6})</STRONG> and it worked. However i see entire log snippet is being returned instead of just the data present in regex expression.</P> <P>Any idea how to achieve this?</P> Tue, 23 Jul 2019 19:46:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fetch-the-values-from-log-using-regular-expression/m-p/404482#M116990 aqaadi 2019-07-23T19:46:37Z https://community.splunk.com/t5/Splunk-Search/How-to-fetch-the-values-from-log-using-regular-expression/m-p/404483#M116991 <P>This worked thanks</P> Wed, 24 Jul 2019 22:44:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fetch-the-values-from-log-using-regular-expression/m-p/404483#M116991 aqaadi 2019-07-24T22:44:24Z