Having issues with rex

[theouhuios]

Hello

I am not that comfortable yet with rex commands and have been slowly learning it.I want to rex some data from this _raw and facing some issues with it.

I need the bolded datapoints from this raw.

6-Dec-12,R18541,,APPROVED,HDG,,3953,CS,Digital Support,NO,VIRTUAL REUSE,ISCW,2,WINDOWS,4,4,,5297,,,,8,8,8192,12,2012

The rex which I am using to get the first data point is

rex field=_raw "\d+-\w+-\d{2},\[A-Z]d+,,\[A-Z]*,\[A-Z]*,,\d+,\w*,(?<Function>)"

I may be completely wrong too. Can anyone please tell me where am I doing mistake here

More data

6-Dec-12,R18541,,APPROVED,HDG,,3953,CS,Digital Support,NO,VIRTUAL REUSE,ISCW,2,WINDOWS,4,4,,5297,,,,8,8,8192,12,2012

6-Dec-12,R18541,,APPROVED,HDG,,3953,CS,Digital Support,NO,VIRTUAL REUSE,ISCE,2,WINDOWS,4,4,,5297,,,,8,8,8192,12,2012

6-Dec-12,R18541,,APPROVED,HDG,,3953,CS,Digital Support,NO,VIRTUAL REUSE,ISCC,2,WINDOWS,4,4,,5297,,,,8,8,8192,12,2012

5-Dec-12,r16775,,APPROVED,HDG,,2609,st,Computing Environment,YES,VIRTUAL REUSE,ISCE,1,WINDOWS,1,2,,5252,,,,1,2,2048,12,2012

5-Dec-12,R19295,,APPROVED,TCIM,,4255,GFS,Billing & Payments Solution Center,NO,VIRTUAL REUSE,TEST CENTER,3,LINUX,2,8,,5123,,,,6,24,24576,12,2012

5-Dec-12,R16804,,APPROVED,TCIM,,3578,ST,UNIFIED COMMUNICATIONS,NO,VIRTUAL REUSE,TEST CENTER,1,LINUX,4,12,,5121,,,,4,12,12288,12,2012

5-Dec-12,C02088,,APPROVED,TCIM,,,ST,Computing Environment,NO,VIRTUAL REUSE,TEST CENTER,2,WINDOWS,1,2,,5264,,,,2,4,4096,12,2012

5-Dec-12,R19462,,APPROVED,TCIM,,4222,CCS,,NO,VIRTUAL REUSE,TEST CENTER,2,WINDOWS,2,4,,5289,,,,4,8,8192,12,2012

5-Dec-12,R19462,,APPROVED,TCIM,,4222,CCS,,NO,VIRTUAL REUSE,TEST CENTER,1,WINDOWS,4,8,,5289,,,,4,8,8192,12,2012

[cphair]

Your field name "Function" doesn't capture anything. You would need to include a [\w\s]+ inside the closing parenthesis to extract data for the field.

However, your regex probably doesn't need to be this complex. It looks like you're analyzing comma-separated data. If you always have the same number of comma-separated fields, and you always need to extract the 9th, 13th, and 15th fields, you can do something like this:

rex field=_raw "([^,]+,){8}(?[^,]+),([^,]+,){3}(?[^,]+),([^,]+,){1}(?[^,]+)"

Alternatively, you can use eval's mvfind:

... | eval allfields=split(_raw,",") | eval Function=mvfind(allfields, 😎 | ...

etc. (These may not be exact, but they should get you started.)

[theouhuios]

Added some more data to my first post. What it's doing is its capturing Funtion but under function its mixing data in the 9th field with data from other fields like 11 and 12.

[cphair]

You have two other fields bolded; the rex is intended to extract all of them. If you only need Function you can remove the tail end of the regex. It's hard to tell what the solution is without seeing more data.

[theouhuios]

The rex does extract the data but the strange part is its not the correct fields. Its mixing the data from the Function field and few other fields.

[theouhuios]

Any idea on how to solve this? I am still stuck