topic Re: field extraction in Splunk Search https://community.splunk.com/t5/Splunk-Search/field-extraction/m-p/586412#M204281 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/242965">@ranjithan</a>,</P><P>good for you, see next time!</P><P>Ciao and happy splunking.</P><P>Giuseppe</P><P>P.S.: Karma Points are appreciated <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Thu, 24 Feb 2022 13:27:01 GMT gcusello 2022-02-24T13:27:01Z field extraction https://community.splunk.com/t5/Splunk-Search/field-extraction/m-p/586395#M204275 <P><SPAN class="">name</SPAN> <SPAN class="">uuid</SPAN> <SPAN class="">sysfs</SPAN> <SPAN class="">size</SPAN> <SPAN class="">dm-st</SPAN> <SPAN class="">paths</SPAN> <SPAN class="">failures</SPAN> <SPAN class="">action</SPAN> <SPAN class="">path_faults</SPAN> <SPAN class="">vend</SPAN> <SPAN class="">prod</SPAN> <SPAN class="">rev</SPAN></P><P><SPAN class="">mpatha</SPAN> <SPAN class="">360002ac000000000000010e30001c751</SPAN> <SPAN class="">dm-1</SPAN> <SPAN class="">120G</SPAN> <SPAN class="">active</SPAN> <SPAN class="">4</SPAN> <SPAN class="">0</SPAN> <SPAN class="">0</SPAN> <SPAN class="">3PARdata</SPAN> <SPAN class="">VV</SPAN> <SPAN class="">3315</SPAN></P><P><SPAN class="">mpathb</SPAN> <SPAN class="">360002ac000000000000010fb0001c751</SPAN> <SPAN class="">dm-0</SPAN> <SPAN class="">240G</SPAN> <SPAN class="">active</SPAN> <SPAN class="">4</SPAN> <SPAN class="">0</SPAN> <SPAN class="">0</SPAN> <SPAN class="">3PARdata</SPAN> <SPAN class="">VV</SPAN> <SPAN class="">3315</SPAN></P><P>&nbsp;</P><P><SPAN class="">The above is my multiline event in table format...</SPAN></P><P><SPAN class="">I need to extract the below values(mpath, uuid):</SPAN></P><P><SPAN class="">mpatha 360002ac000000000000010e30001c751</SPAN></P><P><SPAN class="">mpathb 360002ac000000000000010fb0001c751</SPAN></P><P><SPAN class="">Please help me. im new to this.. thank you so much..</SPAN></P> Thu, 24 Feb 2022 11:17:21 GMT https://community.splunk.com/t5/Splunk-Search/field-extraction/m-p/586395#M204275 ranjithan 2022-02-24T11:17:21Z Re: field extraction https://community.splunk.com/t5/Splunk-Search/field-extraction/m-p/586396#M204276 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/242965">@ranjithan</a>,</P><P>please try this regex</P><LI-CODE lang="markup">| rex "^(?&lt;name&gt;\w+)\s+(?&lt;uuid&gt;[^ ]+)"</LI-CODE><P>that you can test at&nbsp;<A href="https://regex101.com/r/HsvUJg/1" target="_blank">https://regex101.com/r/HsvUJg/1</A></P><P>Ciao.</P><P>Giuseppe</P> Thu, 24 Feb 2022 11:20:38 GMT https://community.splunk.com/t5/Splunk-Search/field-extraction/m-p/586396#M204276 gcusello 2022-02-24T11:20:38Z Re: field extraction https://community.splunk.com/t5/Splunk-Search/field-extraction/m-p/586405#M204278 <P>thank you so much!&nbsp;</P> Thu, 24 Feb 2022 12:14:53 GMT https://community.splunk.com/t5/Splunk-Search/field-extraction/m-p/586405#M204278 ranjithan 2022-02-24T12:14:53Z Re: field extraction https://community.splunk.com/t5/Splunk-Search/field-extraction/m-p/586412#M204281 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/242965">@ranjithan</a>,</P><P>good for you, see next time!</P><P>Ciao and happy splunking.</P><P>Giuseppe</P><P>P.S.: Karma Points are appreciated <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Thu, 24 Feb 2022 13:27:01 GMT https://community.splunk.com/t5/Splunk-Search/field-extraction/m-p/586412#M204281 gcusello 2022-02-24T13:27:01Z