Parsing comma separated values

[danurag]

I have a script that outputs data in the following format. The problem is that the value of the Error field gets initialized to "No" and ignores the Error part. Also, the Error field could have have a completed stack trace and flow into multiple lines. How do I write the transforms stanza so that it assigns all the values to the "Error" field.

ElapsedTime=2.2812208, StatusCode=OK, ContentMatched=False, Error=No Error

Thank you

[yannK]

try the inline regex,

mysearch | rex field=hop "Error=(?<Error>([^=]*)$)" | table Error

then once confirmed working, you can define an automatic field extraction
see http://docs.splunk.com/Documentation/Splunk/4.2.5/Knowledge/Managesearch-timefieldextractions

[danurag]

Hi MuS, I need help with writing the complete regex. Could you please give me some pointers.

Thanks.

[MuS]

Hi danurag

you can use a regex like this ([^=]*)$ to match everything after the last = to be extracted

cheers