splitting key/value pair from a field without space

[anasar]

Hi,

One of my field is dc_size, which has value "US_0UK_9SG_20CA_5". Please let me know how to split it to key value pair as,
US 0
UK 9
SG 20
CA 5

and graph trends for US, UK, SG and CA.

Thank you.

[javiergn · Accepted solution]

Either this if you want it to be multivalued (ignore the first two lines that I used to replicate your use case):

| stats count | fields - count
| eval raw = "US_0UK_9SG_20CA_5"
| rex field=raw max_match=0 "(?<DC>[A-Za-z]+)_(?<Size>\d+)"
| table DC, Size

Or this if you want it to be separate events:

| stats count | fields - count
| eval raw = "US_0UK_9SG_20CA_5"
| rex field=raw max_match=0 "(?<DCSize>[A-Za-z]+_\d+)"
| mvexpand DCSize
| rex field=DCSize "(?<DC>[A-Za-z]+)_(?<Size>\d+)"
| table DC, Size

[anasar]

sorry for the delay javiergn. your answers worked perfectly for me.