How do I extract these strings from my sample event as values into their own fields?

[vrmandadi]

=Application
SourceName=RGFXQA
EventCode=55
EventType=3
Type=Warning
ComputerName=UPS6Z445201Y3.upstreamaccts.XOM.com
TaskCategory=%1
OpCode=Info
RecordNumber=106286
Keywords=Classic
Message=C: has 114.6 GB free of 222.5 GB Total.

I have the above event where type, soucername, keywords, message etc are fields. How can I make the 114.4 GB a field called freespace and 222.5 GB as available space

[richgalloway · Accepted solution]

Use rex

your search | rex field=Message "has (?<freespace>.+ GB) free of (?<totalspace>.+ GB)" | ...

[vrmandadi]

Thank you so much brother.how can I do the freespace percentage like freespace%=(totalspace-freespace)/100.I tried using the eval command but it is not working.Can you please help in this

[richgalloway]

This should do it

... | eval pcfree=freespace/totalspace*100 | ...

[vrmandadi]

I tried using your command but it is showing all blank

[richgalloway]

Does

your search | rex field=Message "has (?<freespace>.+ GB) free of (?<totalspace>.+ GB)" | table freespace totalspace

show any data?