Extract multiple groups (rex), key/value pairs comma separated

[ejwade]

I'm looking for the regular expression wizards out there. I need to do a rex with two capture groups: one for name, and one for value. I plan to use the replace function, and throw everything else away but those two capture groups (e.g., "\1: \2").

Here are some sample events.

name="Building",value="Southwest",descendants_action="success",operation="OVERRIDE"
name="Building",value=["Northeast","Northwest"],descendants_action="failure",operation="OVERRIDE"
name="Building",value="Southeast",descendants_action="success",operation="OVERRIDE"
name="Building",value="Northwest"
name="Building",value="Northwest",operation="OVERRIDE"

So far I just have this.
^name=\"(.*)\",value=\[?(.*)\]?

Any ideas?

[ITWhisperer · Accepted solution]

Try something along these lines

^name=\"([^\"]*)\",value=(\[([^\]]+)\]|\"[^\"]+\")(.*)

https://regex101.com/r/id6m8s/1

[gcusello]

Hi @ejwade,

you should already have these extractions because usually Splunk identifies the groups fieldname=fieldvalue.

Anyway, please try this regex:

name\=\"(?<name>[^\"]*)\",value\=\[*\"(?<values>[^\"]*)

that you can test at https://regex101.com/r/PEszES/1

Ciao.

Giuseppe