Field extraction

[kaw243]

Below is an example from an access.log that I am trying to extract the productList from. The number of products numbers change for each request. i.e. some may have 1 product number some may have 5. I need some help in extracting the productList separately.

2013-12-31 12:30:53 0.0010 0 - 204.107.141.40 GET /open-sounthing/compete.html?pagename=myco:getsomething:page7:goodjob&differentinfo=someinfo&productList=4004,4102,4107 200

I would like to be able to pull out the productList and rename them by number to use in pivot
4004= corn
4102= viper
4107= dog

[martin_mueller · Accepted solution]

This would get you a multivalue field with the three productIds:

... | rex "productList=(?<productId>(\d+,?)+)" | makemv productId delim=","

[somesoni2]

Then you can have lookup file containing productId and productionName and do a lookup to get productName into your result.

...@martin's search | lookup productiondetail.csv productId OUTPUT productName

[kaw243]

Thanks that worked