How to extract fields values including keywords

[Mr_Adate]

I have three fields like "

field1=SGSIFASFFWR035A

field2=AXAZCBDM02

fields3=ESESDFAADFSABBM00002

in above examples I want to extract field values like these;

field1=FWR035A (any character after FW* including FW)

field2=BDM02 (any character after BDM* including BDM)

fields3=BBM00002 (any character after BBM* including BBM )

additionally, I want to  to use single  command to extract all three field values in one go.

like "FW*|BDM"|BBM*"

I am using below rex command to extract it but it is not including FW keyword in extracted field

| rex field= field1 "FW(?<AFTERTHISKEYWORD>\S+)"

if you can provide a workable solution either using rex and eval or another code, it would be appreciated.

Thanks in advance..

[Mr_Adate]

I have uploaded .csv file 

Firewall	Interface	Description
SGSIFASFFWR035A	port8	xafdy
AXAZCBDM02	port15.2	wawfesvcds
ESESDFAADFSABBM00002	port11	asdfasdf

I want to extract field values from Firewall field name

[gcusello]

Hi @Mr_Adate,

have you in your props.conf the "INDEXED_EXTRACTIONS = csv" option ?

If yes, you should already have the data separated as fields.

Tiy can find many video that describe how to do it, e.g. https://www.youtube.com/watch?v=3kx0OGKy_XU

Ciao.

Giuseppe

[Mr_Adate]

Thanks for your reply.. 

I have uploaded file as lookup not props.conf.

[ITWhisperer]

rex can't be used to operate on more than one field at a time. However, you could operate on _raw, but in order to help you, you would need to share some examples of your raw events (not just the fields you have already extracted).

[Mr_Adate]

I don't have _raw filed as I am uploading file from csv format 

[gcusello]

Hi @Mr_Adate,

could you share some sample of your logs to test the regex?

then, if you already have fields1, field2 and field3 and you want to take all the content, including prefix, whay do you need a regex?

Ciao.

Giuseppe