I'm trying to extract fields from a message containing the following string..
'database'=running 'management'=running 'runtime'=running 'adclient'=running 'ntpd'=running 'logforward'=running,
I'm trying to create fields such as database, management, etc. that will store a value of running, down, etc. I tried using regex from the interactive field extractor but once I try to extract 'runtime' or anything past that, no regex can be extracted. Are there any simple ways of doing what I need to do?
Splunk can parse events of the form field=value, but I think the quotes in your example will be problematic.
A rex query is simple enough, assuming your fields are always in the same order.
<search> | rex "'database'=(?<database>\w+)\s'management'=(?<management>\w+)\s'runtime'=(?<runtime>\w+)\s ..." | ...
This works in RegExr, but I haven't verified the quotes won't confuse Splunk.