How to write a rex extraction based on the count of a previous field value?

[dkarthik16]

I have a log like this

1000107KARTHIk100203YES

I want to extract like this
1000 07 KARTHIK
1002 03 RITHVIK

where
1000 - Fixed length
07 - Fixed length
KARTHIK - Based on the previous value (07) I need to set the length of the this field.

I tried like this

"(?P<FieldId>[^}]{3}+)(?P<FieldCount>[0-9]{2}+)(?P<FieldValue>[0-9a-zA-Z]{**?**}+)"

Thanks in advance!

[woodcock · Accepted solution]

I can't think of a way to do it in a single RegEx but how about 2 pipelined commands like this:

... | rex "(?<FieldId>.{4})(?<FieldCount>.{2})(?<FieldValue>.*)" | eval FieldValue=substr(FieldValue,1,FieldCount)

[dkarthik16]

First of all thanks for the reply...
Here I cannot able to use max_match with rex by which I can able to find out all the records in that line.

[dkarthik16]

Hi WoodCock,

I can able to extract the information from the log using your answer which you posted with one of my colleague's question (the same question) with minor modification of query.

| rex field=_raw "(?.{3})(?.{2})(?.*)"
| eval FieldValue=substr(TempFieldValue,1,FieldValueLen)
| eval TempFieldValue=substr(TempFieldValue,1+FieldValueLen)
| eval subevent=(TransactionCode . ":::" . FieldValueLen . ":::" . FieldValue)

| rex field=TempFieldValue "(?.{3})(?.{2})(?.*)"
| eval TransactionCode=mvappend(TransactionCode, TempTransactionCode)
| eval FieldValueLen=mvappend(FieldValueLen, TempFieldValueLen)
| eval FieldValue2=substr(TempFieldValue,1,TempFieldValueLen)
| eval FieldValue=mvappend(FieldValue, FieldValue2)
| eval TempFieldValue=substr(TempFieldValue,1+TempFieldValueLen)
| eval subevent=mvappend(subevent, TempTransactionCode . ":::" . TempFieldValueLen . ":::" . FieldValue2)

| mvexpand subevent
| rex max_match=5 field=subevent "(?.?):::(?.?):::(?.*)"

| table TransactionCode FieldValueLen FieldValue

By repeating the Bold set of query i can able to extract all the information from the log.

Is there any way to auto iterate this query (loop)? So that i can able to extract "n" number of such records upto end of line which is more or less equal to max_match.

[woodcock]

Because we could not get the first pass into a single rex command, the answer is "no". However, we can clean it up quite a bit by putting part or all of it into a macro, which is what I suggest that you do.

[dkarthik16]

Sure will try that..Thanks

[woodcock]

Don't forget to "Accept" an answer to close of the question (up-voting useful comments is also appreciated).

[dkarthik16]

Sorry for the mistake in the sample data
1000 07 KARTHIK
1002 07 RITHVIK