Use Regex to extract data from _raw and rename the extracted field

[promukh]

Hello  Splunkers,

Please advise how to use regex to extract the below specific fields from _raw data and also add/rename the field name.The Index is a summary Index 

Sample Raw Data:

"cutom_id":"nuyc0989","group_na":"vc_iod","kit_num":"tach-98"

"cutom_id":"nuyc0989","group_na":"no_eng","kit_num":"vch-76"

"cutom_id":"nuyc0989","group_na":"vc_hk","kit_num":"tach-k89"

I only want to extract {field:value} of "group_na" (rename field to assigned_to) & "kit_num" (rename field to Tax_ID) in the search results for all the _raw data of the summary index.

Below search query is not extracting the required field from the raw data ,please advise 

Search Query - 

index=<summary_index> | rex field=_raw "\"group_na\": (?<assgined_to>*)"

[bowesmana]

Your rex expression is wrong and "assgined_to" is spelt incorrectly.  You can do it either with rex as in your original example

| makeresults
| eval _raw="\"cutom_id\":\"nuyc0989\",\"group_na\":\"vc_iod\",\"kit_num\":\"tach-98\";\"cutom_id\":\"nuyc0989\",\"group_na\":\"no_eng\",\"kit_num\":\"vch-76\";\"cutom_id\":\"nuyc0989\",\"group_na\":\"vc_hk\",\"kit_num\":\"tach-k89\""
| eval data=split(_raw,";")
| mvexpand data
| fields data
| rename data as _raw
| rex field=_raw "\"group_na\":\"(?<assigned_to>[^\"]*)"
| table assigned_to

or using extract like this

| makeresults
| eval _raw="\"cutom_id\":\"nuyc0989\",\"group_na\":\"vc_iod\",\"kit_num\":\"tach-98\";\"cutom_id\":\"nuyc0989\",\"group_na\":\"no_eng\",\"kit_num\":\"vch-76\";\"cutom_id\":\"nuyc0989\",\"group_na\":\"vc_hk\",\"kit_num\":\"tach-k89\""
| eval data=split(_raw,";")
| mvexpand data
| fields data
| rename data as _raw
| extract pairdelim="," kvdelim=":"
| rename group_na as assigned_to
| fields assigned_to

extract will work on raw and take key/value pairs from your data

[promukh]

Thank you @bowesmana   , how can i extract multiple fields , is the below syntax correct for extracting multiple fields , its not giving me any o/p.

| rex field=_raw  "\"group_na\":\"(?<assigned_to>[^\"]*) \cutom_id\":\"(?<cust_id>[^\"]*)" | table assigned_to,cust_id

[promukh]

for extract pairdelim=","  kvdelim=":" ,   i am having trouble extracting the data from _raw for below specific formats , for the rest it works fine  , any clue how we can we fix this  ? 

"j_yul_flt.name":"3-4tux","b_ccl_flt.guv":"7-6bno","j_nyc_flt.name":"3-4iot","b_chp_flt.guv":"7-6ews"

[bowesmana]

This appears to work.

| makeresults
| eval _raw="\"j_yul_flt.name\":\"3-4tux\",\"b_ccl_flt.guv\":\"7-6bno\",\"j_nyc_flt.name\":\"3-4iot\",\"b_chp_flt.guv\":\"7-6ews\""
| extract pairdelim="," kvdelim=":"

extract always works on the _raw field