extract part of a string from the fields

[karthi25]

I am having the comments field with the data below:

'ADP-ECS~FILEMANIFEST~20171228-221014~60.txt.gz and ADP-ECS~FILEMANIFEST~20171228-221014~60.txt.gz.doneTask Completed Successfully '    

'Filename is SAP-ADP~DEVICEUSAGE~20171227-005707~4596654.txt.gz and Token Name is SAP-ADP~DEVICEUSAGE~20171227-005707~4596654.txt.gz.doneTask Failed '  

'ADPT~ADPTWMFMDAILY~20171228-220124~0.txt.gz and ADPT~ADPTWMFMDAILY~20171228-220124~0.txt.gz.doneTask Completed Successfully '

Now I want to extract only the filename for eg: "ADP-ECS~FILEMANIFEST~20171228-221014~60.txt.gz" and status like below

filename                                                                                                                  status
--------------------------------------------------------------------------------------------------------------------------------------
ADP-ECS~FILEMANIFEST~20171228-221014~60.txt.gz                                  Completed
SAP-ADP~DEVICEUSAGE~20171227-005707~4596654.txt.gz                              Failed
ADPT~ADPTWMFMDAILY~20171228-220124~0.txt.gz                                     Completed   

Kindly help me to do it.

[Elsurion · Accepted solution]

Ok it took a bit to create this regex for this comment.

| rex field=comment "'(Filename\sis\s)?(?<filename>\S+)\s+and\s+(Token\sName\sis\s)?(?<token>\S+)\s+((?<status>\S+)(\s\S+)?)"

This regex works on both types of comment.

[nickhills]

This regex seems to work with your sample data.
'(Filename is\s)?(?<filename>.+?\.gz).*Task(?<status>.*)'

In a search you could run

<your search>|rex field=comment "'(Filename is\s)?(?<filename>.+?\.gz).*Task(?<status>.*)'"|table filename status