Chart a specific value

[mxgaccount]

Sorry... I'm completely new to this.
I have used punct (search feature) to select the type of record from my home automation log. Now I want chart the various values within the "C|22|23|16|23|OFF|ON|OFF|OFF|NORMAL" (example below). The first value is unit of temp, second is Temp Set point, third is the actual house temp, etc. I've read through the docs and tried the field extraction using interactive (IFX) to develop a rex.. but I am unsuccessful in creating fields. Is there another way?

2011-06-09 06:10:51.340 02:21:50.5169187 (017) I0 Broadcasted notification: ["ZWAVE:22", "C|22|23|16|23|OFF|ON|OFF|OFF|NORMAL"] for device [Thermostat]

Thanks in advance.

[mxgaccount]

Thank you!!! This has enabled me to chart in many ways!
It's working.

[mw · Accepted solution]

You can do your search and pipe into the "rex" command to extract fields directly within the search. This is a good way to test through the extraction.

sourcetype=my_sourcetype | rex "Broadcasted notification: \[\"ZWAVE:22\", \"(?<temp_unit>\w)\|(?<temp_setting>\d+)\|(?<temp>\d+)\|(?<other1>\d+)\|(?<other2>\d+)\|(?<switch1>\w+)\|(?<switch2>\w+)\|(?<switch3>\w+)\|(?<switch4>\w+)\|(?<state>\w+)\"\] for device \[(?<device_name>\w+)\]"

Once you're happy with everything, it's best to take that extraction and make it permanent. You can go to "Manager" -> "Fields" -> "Field Extractions" -> "Add New":

[my_sourcetype]
EXTRACT-thermodata = Broadcasted notification: \[\"ZWAVE:22\", \"(?<temp_unit>\w)\|(?<temp_setting>\d+)\|(?<temp>\d+)\|(?<other1>\d+)\|(?<other2>\d+)\|(?<switch1>\w+)\|(?<switch2>\w+)\|(?<switch3>\w+)\|(?<switch4>\w+)\|(?<state>\w+)\"\] for device \[(?<device_name>\w+)\]

Once you do that, you won't have to specify the nasty "rex" piece during your searches, and you can do stuff like:

sourcetype=my_sourcetype | timechart avg(temp)