How to extract fields without regex?

[ahooper239]

I'm trying to extract fields from a message containing the following string..

'database'=running 'management'=running 'runtime'=running 'adclient'=running 'ntpd'=running 'logforward'=running,

I'm trying to create fields such as database, management, etc. that will store a value of running, down, etc. I tried using regex from the interactive field extractor but once I try to extract 'runtime' or anything past that, no regex can be extracted. Are there any simple ways of doing what I need to do?

[richgalloway]

Splunk can parse events of the form field=value, but I think the quotes in your example will be problematic.

A rex query is simple enough, assuming your fields are always in the same order.

<search> | rex "'database'=(?<database>\w+)\s'management'=(?<management>\w+)\s'runtime'=(?<runtime>\w+)\s ..." | ...

This works in RegExr, but I haven't verified the quotes won't confuse Splunk.