Extracting through inconsistent data

[srinivas_gowda]

Hello all,

Have been trying to extract the values through an inconsistent data as below. Highlighted values needs to be extracted, however the default extrcation through the tool is not working as expected. Could you please help in this.

50271234,00004105,00000000,1600,"20210901225500","20210901225500",4,-1,-1,"SYSTEM","","psd217",46769359,"MS932","KAVS0263-I \x83W\x83\x87\x83u(AJSROOT1:/\x90V\x8A_\x96{\x94ԏ\x88\x97\x9D/\x92l\x8ED\x94\xAD\x8Ds/04_\x92l\x8ED\x8Ew\x8E\xA6\x83f\x81[\x83^\x98A\x8Cg_\x8CߑO1TAX/V9B01_B:@5V689)\x82\xF0\x8AJ\x8En\x82\xB5\x82܂\xB7(host: UXC510, JOBID: 56620)","Information","jp1admin","/Example/JP1/AJS2","JOB","AJSROOT1:/\x90V\x8A_\x96{\x94ԏ\x88\x97\x9D/\x92l\x8ED\x94\xAD\x8Ds/04_\x92l\x8ED\x8Ew\x8E\xA6\x83f\x81[\x83^\x98A\x8Cg_\x8CߑO1TAX/V9B01_B","JOBNET","AJSROOT1:/\x90V\x8A_\x96{\x94ԏ\x88\x97\x9D/\x92l\x8ED\x94\xAD\x8Ds/04_\x92l\x8ED\x8Ew\x8E\xA6\x83f\x81[\x83^\x98A\x8Cg_\x8CߑO1TAX","AJSROOT1:/\x90V\x8A_\x96{\x94ԏ\x88\x97\x9D/\x92l\x8ED\x94\xAD\x8Ds/04_\x92l\x8ED\x8Ew\x8E\xA6\x83f\x81[\x83^\x98A\x8Cg_\x8CߑO1TAX/V9B01_B","START","20210901225500","","",16,"A0","AJSROOT1:/\x90V\x8A_\x96{\x94ԏ\x88\x97\x9D/\x92l\x8ED\x94\xAD\x8Ds","A1","04_\x92l\x8ED\x8Ew\x8E\xA6\x83f\x81[\x83^\x98A\x8Cg_\x8CߑO1TAX","A2","V9B01_B","A3","@5V0689","ACTION_VERSION","0600","B0","n","B1","1","B2","jp1admin","B3","psd217","C0","UXC510","C1","","C6","r","H2","677758","H3","j","H4","q","PLATFORM","NT",

50270531,00003A71,00000000,3588,"20210901224800","20210901224800",4,-1,-1,"SYSTEM","","PSC611",565029,"MS932","""SE_LOG: User - GetStringS: Failed to LookupAccountName. Domain (\\SERVER-retailing.group), Name (SERVER\QVADMIN). System Error""","Error","","/Example/JP1/NTEVENT_LOGTRAP/QlikViewServer","LOGFILE","NTEVENTLOG","LOGFILE","NTEVENTLOG","","","","","",9,"A0","1630504080","A1","PSC611.H2O-retailing.group","A2","Application","A3","Error","A4","None","A5","300","A6","N/A","PLATFORM","NT","PPNAME","/HITACHI/JP1/NTEVENT_LOGTRAP",

Highlighted fields are the ones I am trying to extract here.

Thank you

[richgalloway · Accepted solution]

It would help if you said how the tool (which tool?) is not living up to expectations.

Have you tried this regex?

(?:[^,]+,){3}(?<field1>[^,]+),(?:[^,]+,){9}"(?<field2>[^"]+)","(?<field3>[^"]+)","(?<field4>[^"]+)","(?<field5>[^"]+)",".*?","(?<field6>[^"]+)

[srinivas_gowda]

Hello,

I tried and I am getting the below error.

Error in 'SearchParser': Missing a search command before '^'. Error at position '92' of search query 'search index=*jp1* | rex field=_raw "(?:[^,]+,){3}...{snipped} {errorcontext = ?<field2>[^"]+)","(?<}'.

And when I use escape before the " like below

| rex field=_raw "(?:[^,]+,){3}(?<field1>[^,]+),(?:[^,]+,){9}\"(?<field2>[^"]+)\",\"(?<field3>[^"]+)\",\"(?<field4>[^"]+)\",\"(?<field5>[^"]+)\",\".*?\",\"(?<field6>[^"]+)"

Still the below error.

Error in 'SearchParser': Mismatched ']'.

Thank you.

[richgalloway]

Quotation marks embedded in the rex command must be escaped with three backslashes.