topic Re: Will you help me create the regex to convert the following data into a column value pair? in Splunk Search

Will you help me create the regex to convert the following data into a column value pair?

ppanchal — Fri, 21 Dec 2018 17:23:22 GMT

Hi,

Below is my sample payload. I want to convert/display it into a column value pair.
Eg, ESBTransactionID
75010569

Any help is appreciated.

75010569\n  OCS\n  \n    Update\n    TKT\n    TKT\n    \n      OCS Driver\n    \n    OCS Driver\n  \n  000141076513003\n  false\n  \n    \n      R_SUBBED\n      TKT

Re: Will you help me create the regex to convert the following data into a column value pair?

woodcock — Fri, 21 Dec 2018 18:17:35 GMT

Like this?

Your search here
| rex "^(?<ESBTransactionID>\d+)"
| table ESBTransactionID

Re: Will you help me create the regex to convert the following data into a column value pair?

richgalloway — Fri, 21 Dec 2018 18:37:11 GMT

See if this helps.

index=foo | rex "(?<ESBTransactionID>^\d{8})" | table ESBTransactionID

Re: Will you help me create the regex to convert the following data into a column value pair?

valiquet — Tue, 29 Sep 2020 22:27:38 GMT

| MAKERESULTS
| Eval s="75010569\n OCS\n \n Update\n TKT\n TKT\n \n OCS Driver\n \n OCS Driver\n \n 000141076513003\n false\n \n \n R_SUBBED\n TKT" |rex mode=sed field=s "s/\\n /=/g" | rex field=s max_match=0 "(?[^=]+)=(?[^=]+)" |fields transaction VALUE | fields - _time