Knowledge Management

field extraction - regex handle fields with no values

pc1234
Engager

I'm trying to write a field extraction on the search head using a regex .

the sample data is as follows

FIELDS: user,email,type,ip

EVENT1: abc,abc@xyz.com,password ,127.0.0.1

EVENT2: xyz,,,127.0.0.5

the fields are comma-delimited whether or not there are values for each fields . In second event, email and type fields have no values(user and ip fields ALWAYS have values) 

Can someone assist me in a regex to handle all fields? if the field has no value (email or type) assign no values to the fields .

Thanks in advance.

 

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
Legend
| rex "(?<user>[^,]*),(?<email>[^,]*),(?<type>[^,]*),(?<ip>[^,]*)"

View solution in original post

0 Karma

ITWhisperer
Legend
| rex "(?<user>[^,]*),(?<email>[^,]*),(?<type>[^,]*),(?<ip>[^,]*)"

View solution in original post

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!