Why is extracted field formatted incorrectly?

[yk010123]

I have the following log that Splunk is not recognizing well :

msg=id=123342521352 operation=write

How can I write a query so that ID is parsed by itself?

The goal is to be able to build a table like :

id	operation
123342521352	write

Unfortunately, when I tried

table id operation

The id is always empty as it does not seem to be parsed correctly

[yuanliu · Accepted solution]

If you look at events, you'll find the field msg with "id" as value.  In SPL, you can use rex to extract id as a field, e.g.,

| rex "msg=id=(?<id>\d+)"