Extraction: How to split the values and search for specific words?

[bollam]

Hello,
I have got a few events with the fields "Information" and "Name". Few events look like below, and I have many such events.

25/08/2018  Information="details-dist-Hyderabad,details-state-Telangana,others-info-testing,details-local-abc,others-testing-info" , Name="abc"
26/08/2018  Information="details-state-Karnataka,details-dist-Bangalore,others-info-testing,others-testing-info,details-local-xyz" , Name="xyz"

The values of the fields are not consistent and it might shuffle the position.
For an instance, The details-dist-Hyderabad in the first event is at position 1 but in the second event it is in the position 2.

I would like to extract the values which contain "details" to a new field and should be placed in a order. So I can use this field for the further extraction.

Output should look like below.

newField = "details-dist-Hyderabad,details-state-Telangana,details-local-abc"
newField = "details-dist-Bangalore,details-state-Karnataka,details-local-xyz"

[nadlurinadluri · Accepted solution]

Hi @bollam,

Try this run anywhere search..

| makeresults a=1
| eval Information="details-dist-Hyderabad,details-state-Telangana,others-info-testing,details-local-abc,others-testing-info"
| append
[ makeresults a1=1
|eval Information="details-state-Karnataka,details-dist-Bangalore,others-info-testing,others-testing-info,details-local-xyz"
]
|rex max_match=0 field=Information "details-dist-(?P\w+)"
|rex max_match=0 field=Information "details-state-(?P\w+)"
|rex max_match=0 field=Information "details-local-(?P\w+)"
|eval newField="details-dist-".dist.",details-state-".state.",details-local-".local
|fields - dist,local,state

[bollam]

@nadlurinadluri, It worked, Thanks for the quick help!!

[nadlurinadluri]

Glad that it helped you 🙂 Happy Splunking!!