How do you extract data from the following field event_message: "P5_Transfer,CLO,2018-08-08 12:12:57,Cardston transfer custom start point."

[aragoma]

The following field after event_message is event_parameters:Film Configuration: {0} Name: {1} DateTime: {2} Note: {3} ,and it has the structure of the previous.

Thank you,

MIguel

[macadminrohit · Accepted solution]

(?<Name>^\w+\,\w+)\,(?P<date_time>\d{1,4}\-\d{1,2}\-\d{1,2} \d{1,2}\:\d{1,2}\:\d{1,2})\,(?P<node>[a-zA-Z0-9_ ]*$)

[macadminrohit]

Then you can write another regex on Name to separate names or use splunk makemv delim="," Name kind of command set.

[aragoma]

Thank you, it worked separating the data in between commas.

[adonio]

@aragoma, if it works for you, kindly accept the answer

[somesoni2]

Could you provide more samples of raw data in the question and highlight which values you want to extract and name(s) of those fields?

[aragoma]

event_message
P5_Sequential,Randall,2018-08-07 13:30:36,custom
P5_Transfer,CLO,2018-08-08 12:12:57,Cardston transfer custom start point
P5_Concurrent,Bryan Johnston,2018-08-26 16:51:58,Fluorescent lights have a 5 second delay before turning off. ove SCENE2 to 5 seconds earlier.
D5_Sequential,Jeff,2018-09-24 09:58:37,Stars w SD at 8:48

The data is separated by comas.

event_parameters
Film Configuration: {0} Name: {1} DateTime: {2} Note: {3}
these correspond to the data in the event_message.

For example
Film Configuration: {0} Name: {1} DateTime: {2} Note: {3}
D5_Sequential, Jeff, 2018-09-24 09:58:37, Stars w SD at 8:48

Miguel