Extract part of the result

[starbac]

Hello,

I have some data in Splunk server that is separated by semicolon ";"
String1=Int1;String2=Int2;String3=Int3...

How can I do to get only String2=Int2 ?

[vnravikumar · Accepted solution]

Hi

Give a try

| makeresults 
| eval msg ="String1=Int1;String2=Int2;String3=Int3" 
| eval temp =split(msg,";") 
| mvexpand temp 
| rex field=temp "(?P<key>.+)=(?P<value>.+)" 
| where key="String2"