How to extract a complex field

[mfscully]

I have a log that has the following:
Blah blah bloh HandleBusInfoMessage=31951592=460892.509; nextcommand Blah HandleSomethingElse=31951592=460892.509 Blah ...

I want to extract the following:
HandleBusInfoMessageCount=31951592
HandleBusInfoMessageTime=460892.509

HandleSomethingElseCount=31951592
HandleSomethingElseTime=460892.509

The command name (Handle*) can be variable.
Thanks for the help in advance.

[mfscully]

One thing I need to add is that the command name (Handle*) can be variable so I would need to rex it I would assume.

[aljohnson_splun]

You could use the Interactive Field Extractor to do this

1. Go to the event
2. Click "Event Actions"
3. Click "Extract Fields"
4. Copy examples of the fields you want from your data into the examples box
5. Test generated regex, edit as needed.
6. Save as field extraction

See this guide (for 6.1).

Note this process becomes significantly easier in 6.2.

[mfscully]

One thing I need to add is that the command name (Handle*) can be variable so I would need to rex it I would assume.

[aljohnson_splun]

After you use the field extractor, you can edit the regex that is generated so that it can accommodate any of the values that might be seen. e.g. [\w\d_+] instead of where it might have generated "Handle". Then you can retest the extraction, and repeat until its perfect.