I need to get the State from that output

[waruike]

| server_state=RUNNING | server_health=Component:ServerRuntime , State:HEALTH_OK , MBean:managed2, ReasonCode:[]

this is the snippet that i need to get the state from

I am a beginner in splunk 

[renjith_nair · Accepted solution]

Try

|rex field=<your filedname> "State:(?<State>.+?),"

Test

|makeresults|eval text="| server_state=RUNNING | server_health=Component:ServerRuntime , State:HEALTH_OK , MBean:managed2, ReasonCode:[]"
|rex field=text "State:(?<State>.+?),"

[waruike]

I need to extract the field and add it to a table

see here

`index_wls` server=* server_state=* domain=* server_health=* | dedup host,server | table host,server ,server_state, 

now from the State I want to add a Row Status to my table to be like

`index_wls` server=* server_state=* domain=* server_health=* | dedup host,server | table host,server ,server_state, Status