Field Extraction with Inconsistent Missing Values Fields in Each of the Events

[SplunkDash]

Hello,

I am some issues in writing field extraction expression for following events (3 sample events are given below).

Each of the events has  comma Separated 14 field values. Most of the cases event doesnot have all field values (i.e., no values between 2 commas)   

I was trying with this expression  ^(?P<Field1>\w+),(?P<Field2>\w+),(?P<Field3>\w+),(?P<Field4>\w+),

But it stuck at Field4 as it doesn't have any values (i.e., no values between 2 commas for Field4) in event  1. Same thing is happening for other events where there is now value between 2 commas. How would I write my field extraction expression (or (REGEX)  ) to extract  14 fields from each of the events considering some fields may not have values (i.e., no values between 2 commas). Any help will be highly appreciated. Thank you so much, appreciate your support in this efforts.

23SRFBB,HESR2,000000000,,TRY5gNbkVnedIIRbrk0A3wWOtE4L,12.218.76.129,2021-10-13 06:39:48 MDT,ISDMCISA,LOGOFF,USER,,,,

34SWFBB,RESG3,000000000,10AB,TFG3nNbkVnedIIDFbrk0A3wWOtE4L,,2021-10-13 06:39:48 MDT,ISDMCISA,LOGOFF,USER,,,,

45SRFBB,SES3X,000000000,,FDTt3nNbkVnedIIBSbrk0A3wWOtE4L,12.218.76.129,2021-10-13 06:39:48 MDT,ISDMCISA,LOGOFF,USER,,,1wqa,XY355

[ITWhisperer · Accepted solution]

Change the + (1 or more) to * (0 or more) for any (or all) fields which might be empty

^(?P<Field1>\w+),(?P<Field2>\w+),(?P<Field3>\w+),(?P<Field4>\w*),