Split square bracket expression: How to separate out below fields in table format?

[drogo]

Hi,

I want to separate out below fields in table format.

Raw = Namespace [com.sampple.ne.vas.events], ServiceName [flp-eg-cg], Version [0.0.1], isActive [true], AppliationType [EVENT]

Query I am using =
| eval Namespace=mvindex(split(mvindex(split(_raw, "Namespace "),1),"],"),1)
| eval ServiceName=mvindex(split(mvindex(split(_raw,"ServiceName "),1),"],"),0)
| eval Version=mvindex(split(mvindex(split(_raw,"Version "),1),"],"),0)
| stats latest(Namespace) as Namespace latest(ServiceName) as ServiceName latest(Version) as Version by host
| sort -Version

Expected result

Host	AppName	ServiceName	Version

[drogo]

@hanks @richgalloway this help

[ITWhisperer]

| rex max_match=0 "(?<keyvalue>\w+\s\[[^\]]+)"
| mvexpand keyvalue
| rex field=keyvalue "(?<key>\w+)\s\[(?<value>[^\]]+)"
| eval {key}=value
| fields - keyvalue key value
| stats values(*) as * by _raw

[drogo]

Thanks @ITWhisperer 

[richgalloway]

It would help to know what results your query returned and why those results aren't good enough.

I prefer the rex command for extracting fields.  The regular expressions below look for the given keyword then extract what's between the following square brackets.

| rex "Namespace \[(?<Namespace>[^\]]+)"
| rex "ServiceName \[(?<ServiceName>[^\]]+)"
| rex "Version \[(?<Version>[^\]]+)"
| stats latest(Namespace) as Namespace latest(ServiceName) as ServiceName latest(Version) as Version by host
| sort -Version