Convert a string to table in splunk

[bharat149]

Hi All i have result in the below format :
"From abc customerId YETNAKCNK, operation create,consumedUnits 0"
"From abc customerId YETNAKCNJ, operation update,consumedUnits 2"

I have to convert the below data to the following format : 
customerId               operation           consumedUnits

YETNAKCNK.             create                           0

YETNAKCNJ               update                          2

[bharat149]

and if i want to apply filter for the customer Id

[kamlesh_vaghela]

jus add
| where customerId="YETNAKCNK"

[kamlesh_vaghela · Accepted solution]

@bharat149 

Can you please try this?

YOUR_SEARCH
| rex field=_raw "customerId (?<customerId>.*),\soperation\s(?<operation>.*),consumedUnits\s(?<consumedUnits>.*)"
|table customerId operation consumedUnits

Sample Search

| makeresults 
| eval event="From abc customerId YETNAKCNK, operation create,consumedUnits 0|From abc customerId YETNAKCNJ, operation update,consumedUnits 2" 
| eval event=split(event,"|") 
| mvexpand event 
| rename event as _raw
| rex field=_raw "customerId (?<customerId>.*),\soperation\s(?<operation>.*),consumedUnits\s(?<consumedUnits>.*)"
|table customerId operation consumedUnits