Extracting data from a search table

[ssaini5]

Hello,

I have a raw data file from which I am trying to extract data and create a dashboard out of it. From this raw file I am using regex and mvexpand to parse the data for individual vm's and storing that information in a table. Now I want to use the data that is store in the table to extract fields and data from it. 

I have regex query to extract particular fields as data. However, I am unable to give the table as an input for to make those regex work. 

Splunk query: 

index="test_log" source="/var/tmp/logs/test.log" | rex max_match=0 field=_raw "(?<lineData>[^;]+)" | mvexpand lineData | fields lineData | table lineData

Sample raw log file: 

VM_NAME: vm1

Process Process Count

ProcessTestA 0

ProcessTestB 1;

VM_NAME: vm2

Process Process Count

ProcessTestA 0

ProcessTestB 3;

Sample Data in table: 

VM_NAME: vm1

ProcessTestA 0

ProcessTestB 1

---------------------------------------

VM_NAME: vm2

ProcessTestA 0

ProcessTestB 3

Final Data Needed:

VM_NAME	vm1
Process	Process Count
ProcessTestA	0
ProcessTestB	1

Please suggest how can I do this. 

Thank you

[to4kawa · Accepted solution]

sample:

index=_internal |head 1 | fields _raw _time
| eval _raw="VM_NAME: vm1
Process Process Count
ProcessTestA 0
ProcessTestB 1;
VM_NAME: vm2
Process Process Count
ProcessTestA 0
ProcessTestB 3;"
| rex max_match=0 (?s)(?<vm>.*?);
| mvexpand vm
| rex field=vm max_match=0 (?<name>\S+?):?\s(?<value>.*)
| rex mode=sed field=value s/(.*)/\"\1\"/g
| eval tmp=mvzip(name,value,"=")
| rename tmp as _raw
| kv
| table VM_NAME Process ProcessTest*

recommend:

index="test_log" source="/var/tmp/logs/test.log"
| rex max_match=0 (?s)(?<vm>.*?);
| mvexpand vm
| rex field=vm max_match=0 (?<name>\S+?):?\s(?<value>.*)
| rex mode=sed field=value s/(.*)/\"\1\"/g
| eval tmp=mvzip(name,value,"=")
| rename tmp as _raw
| kv
| table VM_NAME Process ProcessTest*

REGEX option is useful.