How to divide a value from a string into fields?

[Luninho]

I have value in field:

value: 10,5 CC,00136;CY,00004;JE,00004;QK,00004

Where  CC,CY,JE - type message and there are more of them than in example

00136,00004 - number of message

But I need to get table:

Type	Count
CC	136
CY	4
JE	4

How can i do it with SPL language?

[johnhuang]

Assuming the type is always 2 uppercase alphabet characters:

| rex field=value "\s(?<_raw>([A-Z]{2}\,\d{5}\;)+([A-Z]{2}\,\d{5})?)"
| extract kvdelim="," pairdelim=";" 
| transpose | regex column="[A-Z]{2}"
| rename column AS Type "row 1" AS count 
| eval count=tonumber(count)
| table Type count

You can substitute with this regex to extract the pattern from your raw data instead of the field value -- test to see which works better. 

| rex "\s(?<_raw>([A-Z]{2}\,\d{5}\;)+([A-Z]{2}\,\d{5})?)"

[gcusello]

Hi @Luninho,

are the types in fixed positions?

if they are in fixed posiztion (e.g. 1st, 3rd 5th position) or identificable e.g. for a newar char (e.g. ; just before), you can create a regex to extract them, otherwise it's very difficoult.

Cold you share some additional samples?

From the one you shared the only rule I can identify is that there's a comma just after, it always has a two upper char.

If this is correct you could creat a regex like this:

| rex "(\s|;)(?<Type>\w\w),"

that you can test at https://regex101.com/r/GuqZpU/1

Ciao.

Giuseppe