How to get fields extracted by two fields?

[kc_prane]

 i need  the fields  extracted  by two fields 

1) Detail message  = before the comma ( I need the full description)

2) Count =  after the comma ( I need the digit count)

RAW Log starts from below :

DETAIL MESSAGE, COUNT

Index 0 out of bounds for length 0, 61

No Recipienet found in MDM based on the input parameters, 120

No record found with this document Id, 86

No Records Found with given search Criteria in DB, 52

query did not return a unique result: 2; nested exception is javax.persistence.NonUniqueResultException: query did not return a unique result: 2, 106

You do not currently manage any user roles in PERLSS there is no task data to display at this time, 96

[richgalloway]

This should get you started

| rex "(?<detailMessage>[^,]+), (?<count>\d+)"

[kc_prane]

Thanks, @richgalloway. But here I am only getting the first line for the fields extracted  in the log

[richgalloway]

You say you only get one line, but the screenshot shows 7 lines.

Please provide more information, including the query used and the props.conf settings for the sourcetype.

[kc_prane]

Hi @richgalloway   I don't have much details of the props but the below screenshot shows the rex is working only for the first line.

[richgalloway · Accepted solution]

It was not clear from the OP that the sample data was a single event rather than multiple events.  That means the regular expression matches multiple strings, but the rex command defaults to returning only the first.  Use the max_match option to override that.

| rex max_match=0 "(?<detailMessage>[^,]+), (?<count>\d+)"

This will produce multi-value fields. You'll then need to use mv commands/functions to work with the fields.

Let us know what results you want and we can try to be more specific.

[kc_prane]

Much appreciated mate for your help!. It worked for me.