Rex for a field with varying number of values

[BinnyK]

I have some values in a fied which are email addresses.

eg: Values of F may be
"[""email_type2@gmail.com""]"
"[""email_type1@gmail.com"",""email_type2@hotmail.com""]"
"[""email_type1@live.com"",""email_type2@aol.com"",""email_type3@outlook.com""]"

The field F may have 1, 2 or 3 values. If there is only 1 value, it is going to be email_type2, if there are 2 values it will be email_type1 followed by email_type2 and if there are going to be 3 values, it is going to be email_type1 followed by email_type2 and email_type3.

I need to extract 3 fields, type1, type2 and type3 and include those values in the extracted fields. Can someone help me with this?

[BinnyK]

I created some complex regex, but solved it.

rex field=F "[\"(?.)\",\"(?.)\",\"(?.*)\"]" | rex field=F "[\"(?[^,]+)\",[^,]+]" | rex field=F "[\"[^,]+\",\"(?[^,]+)\"]" | rex field=F "[\"(?[^,]+)\"]"

[somesoni2]

Give this a try

your base search | eval email_type1=mvindex(split(F,","),0) | eval email_type2=mvindex(split(F,","),1) | eval email_type3=mvindex(split(F,","),2)

The value of fields email_type2 and email_type3 will be null for events where they are not available. There may be more value cleanup required, so run the above query and paste the results (if you need cleanup).

[somesoni2]

Is the max number of emails that field F can have is fixed (e.g. 3 as per example)??

[BinnyK]

It can be from 1 to 3.
I can easily use rex to extract fields if it was a fixed number of elements inside. I cant work out a good regex for varying number of elements in each log's F field

[sundareshr]

Try this

... | rex field=F max_match=0 "\"\"(?<em>[^@]+@[^\"]+)\"" | mvexpand em | ...