Identifying Multiple fields with REGEX

[DerekKing]

Hi,

I have a field in the form of;
Key - Value | Key - Value | Key - Value
eg
Derek - 99.00 | Dave - 114.00 | Paul - 89.00

What I would like to do is, extract using a regex all keys and values into different field names.
eg
field1=Derek
value1=99.00
field2=Dave
value2=114.00

The data I need to break out can have between 1 and 10 fields separated by the pipe "|" symbol.

Does anyone know of an elegant regex to pull these fields out? Obviously the pipe symbol is optional at the end of the fields, as I dont know when i've reached the end of the data.

NOTE: I cannot use mvindex (and/or split), as they are running way too slow for the data, so i'm trialling a Regex to speed things up.

So Far, I have this as a concept, but i'm feeling like it's not the best way to attack this.

((?[A-z.]+) - (?\d+.\d+)( | ))((?[A-z.]+) - (?\d+.\d+)( | ))

Any guiding light - much appreciated.
Derek

[landen99]

(?P<field1>\w*)\s*-\s*(?P<value1>[\d\.]*)\s*\|\s*(?P<field2>\w*)\s*-\s*(?P<value2>[\d\.]*)\s*\|\s*(?P<field3>\w*)\s*-\s*(?P<value3>[\d\.]*)

[kristian_kolb]

Or perhaps, to do it in the config files so that it won't clutter up your search query:

props.conf

[your_sourcetype]
REPORT-blah = pipedash

transforms.conf

[pipedash]
DELIMS = "|", "-"

See the docs:
http://docs.splunk.com/Documentation/Splunk/6.2.0/Admin/Transformsconf

/K

The really long version on is also in the docs:
http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/Createandmaintainsearch-timefieldextract...

[dave_vgc]

Hi Derek

You could possibly use a regex pattern that would result in 2 mv fields - something like

... |  rex field=origField "(?P<f1>\b[^-]+)\s-\s(?P<f2>\d+\.\d+)" max_match=10 | table origField f1 f2

[alacercogitatus]

You can use the extract command. http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Extract

<your_search> | extract pairdelim=" | " kvdelim=" - "

This will pull your data into:

Derek=99.00
Dave=114.00
Paul=89.00