Create new Key-Value-Pair out of a Value

[Dreads94]

Hey together,

I've got a problem with extracting multiple key-value-pairs.
At the moment my input looks like this:

PrcTpMem=firefox.exe=1611500, eclipse.exe=1393504, javaw.exe=1180432.

When I extract the fields, it looks like PrcTpMem ist the Key for "firefox.exe=1611500".
The following pair is eclipse.exe=1393504 caused by the comma.
Actually the last way is the way it should look like.
But I've got no idea how to split the first part or how to cut the first part by leaving out "the PrcTpMem=".

In addition I have to manage it by editing the transforms.conf.

The Transforms.conf for this part looks like this at the moment :

[System_Healthy]

DELIMS = ";", ",="

It would be great if someone of you had an idea. Thanks!

[jtrucks · Accepted solution]

Setting up an extract like:

PrcTpMem=firefox.exe=(?<firefox>\d+),\seclipse.exe=(?<eclipse>\d+),\sjavaw.exe=(?<java>\d+)

will pull these out.

However, if the items after PrcTpMem= can be dynamic or numerous, and if the PrcTpMem= string itself is useless to you, look at props.conf section for SEDCMD- to remove that string entirely, which would basically solve your problem immediately upon indexing the new data.

[Dreads94]

Thanks a lot! It worked great.