Regex in splunk

[thambisetty]

Hi,
I have data like below,

Contact_Number---------------Name

land="1234" Phone="324"------Kumar
land="3254" phone="458"------Ramu

Now what i want is Phone number of each and every person like below,

Contact_Number---------------Name

Phone="324"----------------Kumar
phone="458"-----------------Ramu

please help me.
Note:In the data there are only two fields one is "contact number" and another one is "Name",
In the Contact Number there are two fields now i want to extract one field for one Name.

[sanju1323]

Hi,
I also have same doubt..
Thanks man, it worked for me. But, I need only physical as a field. Is it possible through REX. And please suggest me some good website or something to learn entirely about rex command.
Thank you.

[dmaislin_splunk]

* | rex field=_raw "\stype=\"\"(?<type>.+?)\"\""

[dmaislin_splunk]

 * | rex field=_raw "[Pp]hone="(?<Contact_Number>.+?)"-+(?<Name>.+)"

Where your regex is:

[Pp]hone="(?<Contact_Number>.+?)"-+(?<Name>.+)

[dmaislin_splunk]

Just confirming that: type=""physical"" has two double quotes surrounding it? Is this a copied event from Splunk or is it something you manually typed into this answers? The quotes don't make sense since there is a " before date like "date but no end quote.

[thambisetty]

firewall,"date=10-20-2000 time=01:29:22 name=Donated device_id=123456 log_id=654321 type=""phisical"" subtype=block pri=notice
This is one field in my logs. I need to extract type=""phisical"" as a field. pls help using REX

[dmaislin_splunk]

The regex is valid, check it out here: http://regex101.com/r/lY6pS8

Is this data already indexed in Splunk? If so, what is the sourcetype, can you also display the props.conf or transforms.conf for this data?

It this data coming in as a single Splunk event?

[thambisetty]

Thanks for your quick response but its not working..
please do help..