How to create a splunk query for the following problem?

[suvi6789]

Hi , 

Below is my raw data 

{

timestamp: 2023-09-10

Version:1

Kubernetes.namespace: X

Kubernetes.node: Y

App_id:12345

Host: server.ms.com

Log:  21:46:32.268 [[Runtime].uber.471: [dasda-dasf-fasfs-import-1.0.0].vmstats.com] INFO net.das.com - ProcessCPUload=2.39| SystemCPUload=2.55|Initial memory=1.00| Usedheapmemory=0.70|Maxheap memory=0.95|commited_memory=0.95

S_sourcetype=x

Source=lkms

}

Now, If query as index=123 | table log --> I get the complete data in the log field but my aim to create a table with columns as  ProcessCPUload, SystemCPUload, Usedheapmemory, Maxheap memory, commited_memory with their respective values. 

Could you help on how could I achieve this please

[bowesmana · Accepted solution]

Use this rex statement

| rex field=Log "ProcessCPUload=(?<ProcessCPUload>[\d\.]*).+SystemCPUload(?<SystemCPUload>[\d\.]*).+Usedheapmemory=(?<Usedheapmemory>[\d\.]*).+Maxheap memory=(?<MaxheapMemory>[\d\.]*).+commited_memory=(?<commited_memory>[\d\.]*)"

It will generate a bunch of field names and assumes the format of the data will be as shown - if the order of the fields changes in the log, this will not work

[suvi6789]

Ho Bowesmana,
Many thanks for the update. This has fixed my issue and I was able to generate the report that I needed 😊.

[bowesmana]

If this solution helped, please mark it as a solution so others can benefit.

[suvi6789]

Yes, The suggested solution  has worked.