Extract fields from comma seperated list

[jbesant]

Hello, I've just started using Splunk and have managed to extract a few fields from my source to create graphs and a dashboard but I am struggling with the Regx for the following:

04/06/2014 10:30:34,OEL_REPLEN_EVENT,sys_proc op_replen_sequencer,"Product code 71104449, Master TM 81117517, Insert TM 41030090, Quantity 4, Reason OTHER STOCK IN TRAY "

I am trying to extract the information in the message that is between the quotes,i.e. Product Code, Master TM, Reason

There are several different Reason which could be made up of anything between 2 and 4 words. In some cases there will be blank entries after Insert TM.

Hope someone can help! Thanks.

[martin_mueller · Accepted solution]

If that's the first occurrence of double quotes you can use this regex:

,"(?<quoted_field_name>[^"]+)"

[jbesant]

Many thanks that was what I needed. I entered:

(?i) Reason (?P[^"]+)

this and it pulled out all the Reason phrases