How to create custom fields from syslog?

[Splunky21]

Hello, 

I have the following log:

Month date time, ip address, host, [system] 2022 194 16:15:14 X01: Freq error: phase start: -13.5 ns, phase end: +4.7 ns

I'm trying to create custom fields named "Start" and "End" that hold the positive and negative numerical values only, but I am fairly new to field extraction and can't seem to find a way to tie the values to "phase start" and "phase end" without having them included in the field....

[richgalloway]

I'd use the rex command for that.  In the regular expressions, use "phase start" and "phase end" to locate the desired fields, but keep those string out of the capture groups.

| rex "phase start: (?<phase_start>\S+)"
| rex "phase end: (?<phase_end>\S+)"

[jotne]

One regex would do and may be some faster:

| rex "phase start: (?<phase_start>\S+).*end: (?<phase_end>\S+)"

[Splunky21]

This worked! How would I go about saving these as permanent fields that I can create a table with in my search?

[richgalloway]

I'm not sure what you mean by "permanent", but the fields are created by the rex commands and are available for use in the rest of the search.  The field names are inside angle brackets in the regular expressions (phase_start and phase_end).