Extract variable between pipe symbol from log and use it for query

[krishman23]

I have a log generated in splunk which will have unique id  in with pipe symbols:

ex:

19:46:47.146 - [http-nio-8000-exec-9] INFO edu.test.controller |{My Var1}|{My Var2}|{myVar3}| - {log message}.

I need to perform a query based on {My Var1}.

Also need to list (dedup) all logs best on {My Var1}.

[krishman23]

@ITWhisperer: i additional case in this rex, some time my logmessage will have URL as 

Req URL : hello/test/content

 or Req URL : hello/test/content/ , i need to truncate / of second request. Can you help with this ?

[ITWhisperer]

| rex field=events mode=sed "s/(?<url>[^\/]+\/[^\/]+\/[^\/]+)(?<slash>\/*)/\1/g"

[ITWhisperer · Accepted solution]

| rex "\|(?<Var1>[^\|]+)\|(?<Var2>[^\|]+)\|(?<Var3>[^\|]+)\|\s\-\s(?<logmessage>.*)"

[krishman23]

my bad , got it what you are saying.,

As second part of my question how can we user Var1 as variable for next search?

[ITWhisperer]

Depends on what you want to get out of your data

| dedup Var1
| where Var2="xyz"
| stats count by Var3

[krishman23]

but var1,var2,var3  are unknown to me, those are variables in log

[ITWhisperer]

The rex extracts the value between the first two pipes into a field called Var1, the value between the second and third pipes into a field called Var2, etc. You can then use these fields in your query or just display them in as columns in a table. Is this not what you want to do?