Hello,
I am some issues in writing field extraction expression for following events (3 sample events are given below).
Each of the events has comma Separated 14 field values. Most of the cases event doesnot have all field values (i.e., no values between 2 commas)
I was trying with this expression ^(?P<Field1>\w+),(?P<Field2>\w+),(?P<Field3>\w+),(?P<Field4>\w+),
But it stuck at Field4 as it doesn't have any values (i.e., no values between 2 commas for Field4) in event 1. Same thing is happening for other events where there is now value between 2 commas. How would I write my field extraction expression (or (REGEX) ) to extract 14 fields from each of the events considering some fields may not have values (i.e., no values between 2 commas). Any help will be highly appreciated. Thank you so much, appreciate your support in this efforts.
23SRFBB,HESR2,000000000,,TRY5gNbkVnedIIRbrk0A3wWOtE4L,12.218.76.129,2021-10-13 06:39:48 MDT,ISDMCISA,LOGOFF,USER,,,,
34SWFBB,RESG3,000000000,10AB,TFG3nNbkVnedIIDFbrk0A3wWOtE4L,,2021-10-13 06:39:48 MDT,ISDMCISA,LOGOFF,USER,,,,
45SRFBB,SES3X,000000000,,FDTt3nNbkVnedIIBSbrk0A3wWOtE4L,12.218.76.129,2021-10-13 06:39:48 MDT,ISDMCISA,LOGOFF,USER,,,1wqa,XY355
