Pull out details by Rex

[luckyman80]

Hi Expert,

                     Quite new to Splunk . From the example log line below

03:23:05.056 [publish-1] INFO LoggingAuditor - [testout] TracingOutgoing: 8=FIX.4.29=90635=8115=ONMI=SOMEVENUE34=37249=BRX60256=testout 52=20210727-07:23:05.05

Is it possible to pull out in columns headers somehow ? 

LogType=LoggingAuditor

Destination=[testout]

Direction=TracingOutgoing

SendingTime=52=20210727-07:23:05.05 (just the time ) ?

Thanks so much ! 

[luckyman80]

worry what i mean is . I can see the words I need to rex out.. but how do i call the table columns something else like the original post 

LogType=LoggingAuditor

Destination=[testout]

Direction=TracingOutgoing

SendingTime=52=20210727-07:23:05.05 (just the time )

[richgalloway]

Once your fields are extracted you can call them anything you like using the rename command.

... | rename LogType as LoggingAuditor

[richgalloway]

Yes, it's possible and very easy.  The rex command can extract text into fields for you.  Here's an example command that works with the sample event.  You'll need to modify it if I've made incorrect assumptions (like if INFO is not the only level).

| rex "INFO (?<LogType>\w+).*?\[(?<Destination>[^\]]+)] (?<Direction>\w+).*?52=(?<SendingTime>.*)"

You can test your changes at regex101.com

[luckyman80]

Thanks how do I i see it with columns after ? I see the Rex took but this doesn't seem to work after 

rex "INFO (?<LogType>\w+).*?\[(?<Destination>[^\]]+)] (?<Direction>\w+).*?52=(?<SendingTime>.*)"|table LogType, Destination, Direction, SendingTime

[ITWhisperer]

| rex "INFO (?<LogType>\S+)\s-\s(?<Destination>\[[^\]]+\])\s+(?<Direction>[^:]+):.*\-(?<SendingTime>.*)"