How to separate field values from a single field into two unique values?

[Splunkuser542]

Hi,

Using the following event log which has not been extracted, is it possible to seperate the current 'Name:' field to two seperate fields so that I can table the two unique values? For example, the first 'Name:' field renamed to 'To:' and the second 'Name:' field renamed to 'From:'.

--- To Details --- 
Name: John Smith
...
...

--- From Details --- 
Name: Bob Marley
...
...

End result:

To         | From
John Smith | Bob Marley

[niketn · Accepted solution]

@Splunkuser542 , as you might be aware this kind of regular expression extraction depends on pattern before and after the required field value to be extracted. So unless this kind of pattern is not present or explained in your question/sample data, our suggestion might not work for you. Add the following to your search to see if it works:

  <yourCurrentSearch>
 | rex "--- To Details ---\s+Name:\s(?<ToName>.+)"
 | rex "--- From Details ---\s+Name:\s(?<FromName>.+)"

Following is a run anywhere example based on your sample data provided in the question.

| makeresults
| eval _raw=" --- To Details --- 
 Name: John Smith
 ...
 ...

 --- From Details --- 
 Name: Bob Marley
 ...
 ..."
 | rex "--- To Details ---\s+Name:\s(?<ToName>.+)"
 | rex "--- From Details ---\s+Name:\s(?<FromName>.+)"

[Splunkuser542]

Thanks @niketnilay - the first solution worked.