I want to simply take an event and parse EVERYTHING between two strings and make it a field...the built in field extractor in splunk is garbage and does not help with this simple extraction. The string would be like below:
suser=Joe blow cat=Upload Policy - On Corp sourceServiceName=Server01
How can I simply (within the field extractor, not a search), take everything between "cat=" and "SourceServiceName=" and make that into a field called policyName?
In the field extractor, you've option to specify your own regex. You can use cat=(?<FieldNameOfYourChoosing>.+) sourceServiceName=
to extract what you need.