does not appear in the field

[nanachu]

Hi all

I have event like that.
2019-10-26 15:00:09.158, servicename="ROOT2", area="SCP", place="tokyo", path="AAA12345", Default="B", Sn="B", SC="B", update="person"

"path" "place" "area" "servicename" and "Sn" are automatically appear in the field.
When a field is specified, a value such as B appears.

But 　"SC" did not appear automatically. I think it is few.

I need value like B.
I want to make table.

index=main |table path, area, Sn, SC

path,area,Sn,SC
AAA12345,tokyo,B,B
AAA23456,osaka,A,A
AAA34567,nagoya,C,A

What should I do?

Thank you for helping.

[woodcock]

Add this as the first pipe in your SPL:

... | rex "SC=\"(?<SC>[^\"]+)\" ...

[ansusabu · Accepted solution]

You can use regex in the query for extracting 'SC' value.
ex:

SC=\"(?<sc>\w*)\"

[nanachu]

Thank you for helping.
but, it does not work well.

[nanachu]

when I used |rex field=_raw
It work well.
Thank you.