topic Extract fields from a list in Splunk Search

Extract fields from a list

shashank111v — Tue, 09 Nov 2021 20:06:36 GMT

How to extract values from below log file using rex?

Log:

{Attribute(name=xyz, values={'1'}), Attribute(name=attempts, values={'2'}), Attribute(name=Count, values={'0'}), Attribute(name=MemberNumber, values={'31234'})}

Result in table:

1 2 0 31234

Re: Extract fields from a list

ITWhisperer — Tue, 09 Nov 2021 20:19:04 GMT

| rex max_match=0 "\{\'(?<value>[^\']+)\'\}"

Re: Extract fields from a list

shashank111v — Tue, 09 Nov 2021 20:42:28 GMT

Thank you! But I want to extract four different columns with values related to it.

Name attempts count membernumber

1 2 0 31234

Re: Extract fields from a list

ITWhisperer — Tue, 09 Nov 2021 21:18:49 GMT

| rex max_match=0 "\{\'(?<value>[^\']+)\'\}" | eval name=mvindex(value,0) | eval attempts=mvindex(value,1) | eval count=mvindex(value,2) | eval membernumber=mvindex(value,3)