Please help me in writing the regular expression for the below:
2017-11-17 14:20:03 DueDate="11/17/2017", Identifier="12244", ID Year="1887", ID name="Tool-Based", Pickup Contact Phone#="(123) 123-1234"
I wanted to write regular expressions for all the values that are within the Quotes.
Thanks in advance!
These should ideally be extracted automatically during Search Time Field Discovery with KV_MODE=auto
. Please validate props.conf
for your sourcetype and test out with Verbose Search whether fields get automatically created or not.
Refer to documentation: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf
If you really want to do it during search time, you can try either KV
command or extract
command (with kvdelim="="
and pairdelim=","
). Following is the run anywhere search based on sample data:
With extract
command:
| makeresults
| eval _raw="2017-11-17 14:20:03 DueDate=\"11/17/2017\", Identifier=\"2G1WT57K691118585\", ID Year=\"2009\", ID name=\"Tool-Based\", Pickup Contact Phone#=\"(877) 273-5572\""
| extract kvdelim="=" pairdelim=","
OR with KV
| makeresults
| eval _raw="2017-11-17 14:20:03 DueDate=\"11/17/2017\", Identifier=\"2G1WT57K691118585\", ID Year=\"2009\", ID name=\"Tool-Based\", Pickup Contact Phone#=\"(877) 273-5572\""
| KV
Refer to documentation: https://docs.splunk.com/Documentation/Splunk/latest/Search/Extractfieldswithsearchcommands
@Deepz2612, can you please confirm whether the solution worked for you or not?