How can I extract a complete field containing a comma?

[garywiner]

One of the fields in my data is the form "lastname,firstname". Splunk extracts the last name and moves on to the next field when it reaches the comma. I have tried to create a regex that seems to work in the online regex tester I use, but does not work in my rex clause.

Sample data:

blahdeblah;field21;field22;CallerName=IDAHO,DUNCAN;field24,field25;blahdeblahblah

I am NOT knowledgeable in regex, by any means, but this grabs more than the last name:

rex foo=_raw(?i)CallerName=(?P\S+)

but it produces nothing to look at in my table. Where did I go wrong? TIA

[bchoi_splunk]

| rex field=_raw "CallerName=(?<lastname>\w+),(?<firstname>\w+)" should do the trick. if you want to grab both, "CallerName=(?<Callername>\w+,\w+)"

[richgalloway · Accepted solution]

Your rex command doesn't put the matching text into a field so there's nothing in your table. The following rex command puts everything between 'CallerName=' and the following ';' into a field called 'name'.

rex "CallerName=(?P<name>[^;]+);"