How do I create Fields for MacAddress and UserName?

[jimzzhou]

I have a syslog look like this and I would like to create Fields for MadAddress and UserName.
Any idea?

thanks,

Nov 30 14:54:44 172.20.166.16 ALARM: 1354318234l | system | info | ALR | Station Info Update : MacAddress : 7c:c5:37:60:68:87, UserName : , AP-Id : 44, AP-Name : AP95-GL286, BSSID : 00:12:f2:44:2c:01, ESSID : NGSTV224, Ip-Type : unknown, Ip-Address : 0.0.0.0, L2mode : clear, L3-mode : clear, Vlan-Name : nps, Vlan-Tag : 225

[nmistry_splunk]

It will look something like this -


.. | rex field=_raw "MacAddress : (?<mac>[^,.]*),.*UserName : (?<uname>[^,.]*)" | table mac, uname