Extract Comma seperated fields

[rsantkumar]

I have 3 fields(Key, Version, Date) seperated by comma and records(can be many) seperated by ;(semicolon).

Example: pgn-aemrules,1.1,2020-04-02;pgn-csharp,8.4 (build 15306),2020-02-21;pgn-csharp,8.5 (build 15942),2020-03-16;

I am trying to extract the 3 fields and display as a table in splunk. Please help.

[richgalloway]

Do you want to do this at search time or at index time? Should the data between semicolons be separate events?

[vnravikumar]

Hi

Check this

| makeresults 
| eval str="pgn-aemrules,1.1,2020-04-02;pgn-csharp,8.4 (build 15306),2020-02-21;pgn-csharp,8.5 (build 15942),2020-03-16;" 
| makemv delim=";" str 
| mvexpand str 
| rex field=str "(?P<Key>[^,]+),(?P<Version>[^,]+),(?P<Date>\S+)" 
| table Key Version Date