How to use rex to extract the very next word in a search?

[Akumar294]

Good Day,

I would like to extract a new field called "Status" and the values for this field will be the text right after "status changed to".
For example - Completed, Waiting,Launched,Active.
Is this regex good match?- (Completed|Launched|Active|Waiting), but how to write this in splunk so that it creates a new field called status?

I have data in below form:

310822856,"09/19/2018
02:31:30
PM","Job ""DMS_05_BosLog_Files [88]"" status change to Completed Normally.",Audit,Job Manager,1100,DMS_05_Outbound_Files,88,Production
310822857,"09/19/2018
02:31:30
PM","Job ""02_DMS_BSTORE [89]"" status change to Completed Normally.",Audit,Job Manager,1100,02_DMS_EOD_LOG_ZSTORE,89,
310822848,"09/19/2018
02:31:29
PM","Job ""DFMS_05__Outbound_Files [90]"" status change to Launched.",Audit,Job Manager,1100,DMS_05_Outbound_Files,90,Production
22855,"09/19/2018
02:31:29
PM","Job ""DMS_05_Archive_PosLog_Outbound_Files [91]"" status change to Active",Audit,Job Manager,1100,DMS_05_Outbound_Files,10317045,Production
22840,"09/19/2018
02:31:28
PM","Job ""DMS_05_Archive_PosLog_Outbound_Files [91]"" status change to Waiting On Resource",Audit,Job Manager,1100,DMS_05_Outbound_Files,7045,Production

Note : I am running splunk Cloud

[493669 · Accepted solution]

Hi @Akumar,
try this:

...|rex  "status change to (?<status>\w+)"

this will create new field status and store extracted value

[Akumar294]

Hi Rajesh,

I have tried what you have suggested, but seems like it did not worked out(No fields were extracted)
Probably you can ingest my given few sample data and see if it works?
Please let me know for any further questions.

Thanks,
Ankit

[493669]

I tried below and its working for me-

|makeresults|eval DB="310822856,\"09/19/2018
02:31:30
PM\",\"Job \"\"DMS_05_BosLog_Files [88]\"\" status change to Completed Normally.\",Audit,Job Manager,1100,DMS_05_Outbound_Files,88,Production
310822857,\"09/19/2018
02:31:30
PM\",\"Job \"\"02_DMS_BSTORE [89]\"\" status change to Completed Normally.\",Audit,Job Manager,1100,02_DMS_EOD_LOG_ZSTORE,89,
310822848,\"09/19/2018
02:31:29
PM\",\"Job \"\"DFMS_05__Outbound_Files [90]\"\" status change to Launched.\",Audit,Job Manager,1100,DMS_05_Outbound_Files,90,Production
22855"|rex max_match=0 field=DB "status change to (?<status>\w+)"

[Akumar294]

Thanks a lot Rajesh, it worked!!(There was a minor mistake on my end).
Really appreciate your help.