Help extracting a field from an event

[jlim2003]

Hello, I need help extracting the following value from this sample event:

2015-10-12 09:15:01,590 CDC_HB_RCV C M DT 2015-10-12 13:00:01.980943 2015-10-12 13:00:05.653721 000:00:03.672778 Y
2015-10-12 09:15:01,482 CDC_HB_SEND M <none> RF 2015-10-12 13:15:01.480964

Event types are CDC_HB_RCV and CDC_HB_SEND.

The bolded M in the first event is Destination_Code, required in the CDC_HB_RCV event type. The "C" to the left of it is Source_Code.

However, in the CDC_HB_SEND type, it is blank (no value, since there is no destination code). The Source_Code for that event is M, on the left.

There are multiple CDC_HB_SEND and CDC_HB_RCV events, and they are all under one sourcetype=cdc_heartbeat_log.

I have had trouble extracting since CDC_HB_RCV contains the Destination_Code field, and CDC_HB_SEND does not, however they are all under the same sourcetype.

I have managed to extract all the other relevant fields in the data, except for Destination_Code.

Any assistance is appreciated. Thanks!

[maciep]

You don't need to have all of your extractions in one command. So why not just create a separate extraction for destination code that matches on the actual text "CDC_HB_RCV". Matybe something like this?

CDC_HB_RCV\s\w\s(?<destination_code>\w)

Or is not that consistent? Meaning, can the rcv events not have a dest code? And/Or can some send events have one?