Split Multiple data in column with mutliple delimiter

[bcouavoux]

Hello ! 

I am sorry if the issue has already been addressed. Several topics talk about it but I haven't been able to adapt it to my situation and I am new to Splunk. So I have data always in the same form:

WorkInfo="Job:Initialize job|Result:succeeded|TaskName:|TaskVersion:|IssuesMessages: <br> Job:Checkout  to s|Result:succeeded|TaskName:|TaskVersion:|IssuesMessages: <br> Job:VisualStudioTestPlatformInstaller|Result:succeeded|TaskName:VisualStudioTestPlatformInstaller|TaskVersion:1.151.3|IssuesMessages: <br> Job:TestComplete adapter install|Result:succeeded|TaskName:InstallTestCompleteAdapter|TaskVersion:1.73.382|IssuesMessages: <br> Job:Tests Run : Campagne Globale|Result:skipped|TaskName:VSTest|TaskVersion:2.170.1|IssuesMessages: <br> Job:Post-job: Checkout Talent to s|Result:succeeded|TaskName:|TaskVersion:|IssuesMessages: <br> Job:Finalize Job|Result:succeeded|TaskName:|TaskVersion:|IssuesMessages: <br> Job:Tests Run 1 Tests|Result:failed|TaskName:VSTest|TaskVersion:2.170.1|IssuesMessages:[error] Test Run Failed. \\ [warning] Vstest failed with error. Check logs for failures. There might be failed tests. \\ failed with exit code 1 \\ [error] Vstest failed with error. Check logs for failures. There might be failed tests. <br> Job:QA TestsUI|Result:failed|TaskName:|TaskVersion:|IssuesMessages: <br> Job:Report build status|Result:succeeded|TaskName:|TaskVersion:|IssuesMessages: <br> Job:QA TestsUI_Deploy tc2|Result:failed|TaskName:|TaskVersion:|IssuesMessages:"

So we have several blocks which are separated by a <br>. In these blocks i have :
Job:
Result:
TaskName:
TaskVersion:
IssuesMessages:
Each of this information is separated by a pipe |.

So I would like to display them as a table like this:

I'm not comfortable with regex expression and all my attempts at trying with split and makemv delim have been unsuccessful...

Thank you for your help !

[scelikok · Accepted solution]

Hi @bcouavoux,

Screenshots are always the best 🙂 I think the below query will help you;

| eval WorkInfo=split(WorkInfo," <br> ")
| mvexpand WorkInfo
| rex field=WorkInfo max_match=100 "Job:(?<Job>[^\|]*)\|Result:(?<Result>[^\|]*)\|TaskName:(?<TaskName>[^\|]*)\|TaskVersion:(?<TaskVersion>[^\|]*)\|IssuesMessages:(?<IssuesMessages>[^\|<]*)" 
| table Job Result TaskName TaskVersion IssuesMessages

[bcouavoux]

That exactly what i wanted !
Thank you very much scelikok for your time 🙂

[scelikok]

rex command matches one result default. Please try below;

| rex field=WorkInfo max_match=100 "Job:(?<Job>[^\|]*)\|Result:(?<Result>[^\|]*)\|TaskName:(?<TaskName>[^\|]*)\|TaskVersion:(?<TaskVersion>[^\|]*)\|IssuesMessages:(?<IssuesMessages>[^\|<]*)"
| table Job Result TaskName TaskVersion IssuesMessages

[bcouavoux]

Thanks 
Indeed it is better! I still have a problem (sorry)
I would like every row to be related. I don't know if I can make myself understood but with this regex the data is individual. I would like that every block (that is separated by an <br>) is related.
For example I would like an array like this:

And not as currently:

Sorry for the black rectangle.. 

I don't know if you know what I mean and I also don't know if it's possible..

[scelikok]

Hi @bcouavoux,

Please try below;

| rex field=WorkInfo "Job:(?<Job>[^\|]*)\|Result:(?<Result>[^\|]*)\|TaskName:(?<TaskName>[^\|]*)\|TaskVersion:(?<TaskVersion>[^\|]*)\|IssuesMessages:(?<IssuesMessages>[^\|<]*)"
| table Job Result TaskName TaskVersion IssuesMessages

[bcouavoux]

Hi scelikok,
Thanks for your help !
But this regex return me only the first data 😕 :

[bcouavoux]

The other block data is separed by a <br> and i dont know how to loop the search to display it