how to extract multiple value in field CEF?

[riposans]

hello all

can help me for this? i get data like this

abc=1|productName= SHAMPTS JODAC RL MTV 36X(4X60G);ABC MANIS RL 12X720G;SO KLIN ROSE FRESH LIQ 24X200ML|field23=tip

 i want to extract productName but can't extract because value productName not using " "

so I'm confused to extract it, I've tried it using the spl command

| makemv delim=";" productName

but the only result is SHAMPTS JODAC RL MTV 36X(4X60G). the rest doesn't appear.
and also using regex with the command

| makemv tokenizer="(([[:alnum:]]+ )+([[:word:]]+))" productName

but the result is still the same.

so is there any suggestion so that the value after ; can be extracted?

[PickleRick]

CEF is a fairly annoying format to deal with. It has some part defined one way - as delimited values, and another as key=value pairs. There is an app on Splunkbase for handling CEF events - https://splunkbase.splunk.com/app/487 But I don't remember if it's any good TBH.

[richgalloway]

This question is confusing.  The data appears to be delimited by | yet the SPL uses ; as a delimiter.

If the productName field starts after "productName=" and ends before the next | then this command should extract it.

| rex "productName=(?<productName>[^\|]+)"