How to Split correspondence of multi value fields

[spl_stu]

Please help answer this question, thank you：

For these two multivalued fields, you want the value in the "Recipient" field to correspond to the value in the "recipient_status". If the receipt is successful, it corresponds to ";", If it fails, it corresponds to "'550 5.1.1 resolver.adr.recipnotfound, not found'". Is there a way to segment the values of these two fields and make one-to-one correspondence?

The following are the values corresponding to these two fields
Recipient="@000.com @123.com @456.com @789.com",
recipient_status=";;'550 5.1.1 RESOLVER.ADR.RecipNotFound; not found';"

[ITWhisperer]

The recipient appears to be space delimited - how are the status values delimited?

Is what you have given as your example exactly as it is in the raw event or are these representations of the event field post extraction?

Has the data been extracted to a multi-value field (in the Splunk sense) already or are you looking for help to do that extraction?

[spl_stu]

These two values are the log content automatically extracted by "add on". The corresponding value of "Recipient" is a field, and the corresponding value is the recipient connected by multiple space characters. The complete value of "status" is this content

[ITWhisperer · Accepted solution]

Try something like this (this assumes that the status does not have a semi-colon in)

| rex field=recipient max_match=0 "(?<rcpt>\S+)"
| rex recipient_status max_match=0 "(?i)(?<rcptstatus>(;|'550 5\.1\.1 resolver\.adr\.recipnotfound, not found'))"
| eval recipient_plus_status=mvzip(rcpt, rcptstatus)

[spl_stu]

Thank you very much for your answer. My problem has been solved

[spl_stu]

OK, thank you very much for your answer. I'll test it now