Need regex to extract specific data

[ninadbhaskarwar]

I need a regex to get the output as below -

Input
/ABCD/Safe+Alert+-+ABCD+failure Date: Jun 01,2017
/ABCD / Safe +Alert+-+Xyjw%28s%29+not+working Date: Jun 21,2017

Output
ABCD failure

Xyjw not working

[woodcock]

Like this:

|makeresults |eval raw="/ABCD/Safe+Alert+-+ABCD+failure Date: Jun 01,2017
/ABCD / Safe +Alert+-+Xyjw%28s%29+not+working Date: Jun 21,2017"
| makemv delim="
" raw
| mvexpand raw
| rename raw AS _raw

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| eval output=_raw
| rex field=output mode=sed "s%^/([^/]+)/(?:[^+]*\+){4}(.*) Date.*$%\1 \2% s/\+/ /g"

[ninadbhaskarwar]

Hi I have already tried your solution but output for second line is

"ABCD not working" where as I was expecting "Xyjw not working"

[woodcock]

ARGH! I grabbed the wrong ABCD! I will update; hang on...

[somesoni2 · Accepted solution]

Try like this (run anywhere sample, replace first 2 line with your search, and update the field names per yours)

| gentimes start=-1 | eval temp="/ABCD/Safe+Alert+-+ABCD+failure Date: Jun 01,2017##/ABCD / Safe +Alert+-+Xyjw%28s%29+not+working Date: Jun 21,2017" | table temp | makemv temp delim="##" | mvexpand temp 
| eval temp=urldecode(temp) | rex field=temp "Alert\s*-\s*(?<YourField>[^\:]+)"

Updated Answer

| gentimes start=-1 | eval temp="/ABCD/Safe+Alert+-+ABCD+failure Date: Jun 01,2017##/ABCD / Safe +Alert+-+Xyjw%28s%29+not+working Date: Jun 21,2017" | table temp | makemv temp delim="##" | mvexpand temp 
| eval temp=urldecode(temp) | rex field=temp "Alert\s*-\s*(?<YourField>.+)\sDate\:"

[ninadbhaskarwar]

Output is "ABCD failure Date", I need output without "Date", any suggestion?

[somesoni2]

Try the updated answer.

[woodcock]

Try the updated answer by @somesoni2 😆

[woodcock]

Try my answer.