What is the proper regex syntax to use rex to create 4 new fields?

[akelly4]

I have a log line that looks like the following:

2014-11-28 19:28:42 smx02 postfix/smtp[57736]: 6F7471C73AC_479133AF: to=, relay=127.0.0.1[127.0.0.1]:10025, delay=0.13, delays=0.01/0/0/0.12, dsn=2.0.0, status=sent (250 OK, sent 5479133A_6994_12793_1 8E560172844_479133AB)

I want to use regex to create 4 new fields.

Field1 - 6F7471C73AC_479133AF (number/letter combinations)
Field2 - 5479133A_6994_12793_1 (number/letter combinations)
Field3 - 8E560172844_479133AB (number/letter combinations)
Field 4 - 57736 (Always number)

I know I can use the rex field=FIELDNAME command, but I can't seem to get the syntax to work.

Is there anyone that can point me in the right direction or give me some times on how to create these fields. I really just want to understand the Splunk syntax.

[abhay1991]

/apps/IHSLogs/com-ihs85-pd01-01/IRXWebCommon/access_log_2018-11-16

how to extract this field

[ppablo]

Also, here's a previous Answers posts with a collection of users' favorite resources for regex help 🙂

http://answers.splunk.com/answers/153171/is-there-any-online-regex-tool-to-create-regular-e.html

[richgalloway · Accepted solution]

For problems like this, RegExr is a great tool. Using it and your sample event, I came up with this.

rex "\[(?<Field4>\d+)]:\s+(?<Field1>\S+):[\s\S]+?, sent (?<Field2>\S+) (?<Field3>\S+)"