Thanks ... And as you mentioned there are some mismatches in actual logs and Since the query was written by Humans which doesn't follow any meaningful pattern. Actually I extended my analysis to extract JOINS also. ... View more

Sure will try that..Thanks ... View more

Hi WoodCock, I can able to extract the information from the log using your answer which you posted with one of my colleague's question (the same question) with minor modification of query. | rex field=_raw "(?.{3})(?.{2})(?.*)" | eval FieldValue=substr(TempFieldValue,1,FieldValueLen) | eval TempFieldValue=substr(TempFieldValue,1+FieldValueLen) | eval subevent=(TransactionCode . ":::" . FieldValueLen . ":::" . FieldValue) | rex field=TempFieldValue "(?.{3})(?.{2})(?.*)" | eval TransactionCode=mvappend(TransactionCode, TempTransactionCode) | eval FieldValueLen=mvappend(FieldValueLen, TempFieldValueLen) | eval FieldValue2=substr(TempFieldValue,1,TempFieldValueLen) | eval FieldValue=mvappend(FieldValue, FieldValue2) | eval TempFieldValue=substr(TempFieldValue,1+TempFieldValueLen) | eval subevent=mvappend(subevent, TempTransactionCode . ":::" . TempFieldValueLen . ":::" . FieldValue2) | mvexpand subevent | rex max_match=5 field=subevent "(?.?):::(?.?):::(?.*)" | table TransactionCode FieldValueLen FieldValue By repeating the Bold set of query i can able to extract all the information from the log. Is there any way to auto iterate this query (loop)? So that i can able to extract "n" number of such records upto end of line which is more or less equal to max_match. ... View more

First of all thanks for the reply... Here I cannot able to use max_match with rex by which I can able to find out all the records in that line. ... View more

Sorry for the mistake in the sample data 1000 07 KARTHIK 1002 07 RITHVIK ... View more