Key-Value extraction using rex function

[josknigh]

Is it possible to use the rex command to do a dynamic key=value extraction where they key is a also a regular expression?

I know this can be done with a transform using:

REGEX = (,*?)=(.*?)

FORMAT = $1::$2

Can I do the same thing using rex instead? Maybe something like:

rex field=_raw "(?P<\\FIELDNAME>.*?)=(?<\\VALUE>.*?)"

Is their something I'm missing in the group naming syntax?

I'm looking for a way to do this at search-time rather than index-time without writing a transform.

[lguinn2]

I don't know how to do this with rex, but have you looked at using the DELIMS key word in transforms.conf? If there is a regular pattern in your data that defines fields

name:value name2:value2

then you can specify that with

DELIMS = " ", ":"

More details re: transforms.conf are here Take a look at the examples at the very end of the page.