Multiple fields extraction

[prakashraja1999]

.

[ITWhisperer]

| rex max_match=0 "(?<name>\w+):(?<value>.+?)(?=\s+\w+:|$)"

[ITWhisperer]

This gives you two multi-value fields for the names and the values - if you want corresponding fields created for these, you could do something like this

| rex max_match=0 "(?<_name>\w+):(?<_value>.+?)(?=\s+\w+:|$)"
| streamstats count as _event 
| eval index=mvrange(0,mvcount(_name))
| mvexpand index
| eval _name=mvindex(_name,index)
| eval _value=mvindex(_value,index)
| eval {_name}=_value
| fields - _name _value index
| stats values(*) as * by _event
| fields - _event

Note that extract might not work depending on the consistency of pair delimiters and their inclusion in the value strings.

[richgalloway]

Here are two ideas:  rex command and extract command.

[richgalloway]

The question asked for ideas, not for someone else to do the work.  😀  Did you at least look at the commands?

@ITWhisperer has shown the rex command.  Here is extract:

| extract pairdelim=" " kvdelim=":"

[prakashraja1999]

Kindly share the rex and extract commands