topic How to extract fields without regex? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-without-regex/m-p/198497#M57401 <P>I'm trying to extract fields from a message containing the following string..</P> <PRE><CODE>'database'=running 'management'=running 'runtime'=running 'adclient'=running 'ntpd'=running 'logforward'=running, </CODE></PRE> <P>I'm trying to create fields such as database, management, etc. that will store a value of running, down, etc. I tried using regex from the interactive field extractor but once I try to extract 'runtime' or anything past that, no regex can be extracted. Are there any simple ways of doing what I need to do?</P> Fri, 29 Aug 2014 17:05:25 GMT ahooper239 2014-08-29T17:05:25Z How to extract fields without regex? https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-without-regex/m-p/198497#M57401 <P>I'm trying to extract fields from a message containing the following string..</P> <PRE><CODE>'database'=running 'management'=running 'runtime'=running 'adclient'=running 'ntpd'=running 'logforward'=running, </CODE></PRE> <P>I'm trying to create fields such as database, management, etc. that will store a value of running, down, etc. I tried using regex from the interactive field extractor but once I try to extract 'runtime' or anything past that, no regex can be extracted. Are there any simple ways of doing what I need to do?</P> Fri, 29 Aug 2014 17:05:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-without-regex/m-p/198497#M57401 ahooper239 2014-08-29T17:05:25Z Re: How to extract fields without regex? https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-without-regex/m-p/198498#M57402 <P>Splunk can parse events of the form field=value, but I think the quotes in your example will be problematic.</P> <P>A rex query is simple enough, assuming your fields are always in the same order.</P> <PRE><CODE>&lt;search&gt; | rex "'database'=(?&lt;database&gt;\w+)\s'management'=(?&lt;management&gt;\w+)\s'runtime'=(?&lt;runtime&gt;\w+)\s ..." | ... </CODE></PRE> <P>This works in RegExr, but I haven't verified the quotes won't confuse Splunk.</P> Fri, 29 Aug 2014 19:22:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-without-regex/m-p/198498#M57402 richgalloway 2014-08-29T19:22:45Z