How to extract event_id and STATUS?

[jayakumar89]

I have a single row event that populates the below values and i would like to extract eventid=389643 and STATUS=FINISHED using regex. Could you help me with the regex pattern to extract these values.

2017-10-30 06:48:03,357 [pool-22-thread-1] INFO xxxxxxxxxxxxxxxxxxxxxxx - Email Sent
To : xxxxxxxxxxxxxxxxxxxxxxxx
From : xxxxxxxxxxxxxxxxxxxxxxxxxxxx
Subject : Plan Status - 389643 FINISHED
Body : Plan Status - 389643 FINISHED

[skoelpin]

Try this

| rex Status\s\-\s(?<eventid>\d+)

| rex -\s\d+\s(?<STATUS>\w+)

[s2_splunk]

Try this: <yoursearch> | rex field=_raw "(?<eventID>\d+)\s(?<STATUS>\w+)$"

This assumes that there is nothing in the event after your status value (the RegEx anchors to the end of _raw)

[cpetterborg]

... | rex "Subject : Plan Status - (?<eventID>\d+)\s(?<STATUS>\w+)"

will work if you have additional stuff after that last line.