how to extract 2 different values from a string and put it into 2 fields

[Tannawi_Chauha1]

My data looks like:

A is running
b is running

c is running

each events contain such kind of bunch of data. i want to create 2 fields capturing (A,B,C) in row and other capturing the corresponding status(running) in row.

please provide me needful help

thanks in advance

[javiergn]

Is this what you are trying to achieve?
Feel free to copy and paste into your search box or simply get rid of everything up to the rex and use the right name of your field there to try this out.

| makeresults | fields - _time
| eval sample = "
A is running;
b is running;
c is running;
D is stopped;
E is unreachable
"
| eval sample = split(sample, ";")
| mvexpand sample
| rex field=sample "(?<who>\w+).+?(?<status>\w+)$"
| table who, status

Output (see picture below):

[Tannawi_Chauha1]

actual data is like in place of
A is running;
b is running;
c is running;
D is stopped;
E is unreachable

is
'aaaa bbbb cccc dddd' (1234) is running.
'akdg ytdf tyui tyhj' (1245) is running.
.
.
.like this
so i have to capture only:- aaaa bbbb cccc dddd running in two different field. similary other values.

[javiergn]

Then simply change the regex to:

| rex "\'(?<who>[^\']+)\'.+?(?<status>\w+)$"

[Tannawi_Chauha1]

none of the solution work out....:(

[javiergn]

Can you post the query here?

This works fine for me:

| makeresults | fields - _time
| eval sample = "
'aaaa bbbb cccc dddd' (1234) is running;
'akdg ytdf tyui tyhj' (1245) is running
"
| eval sample = split(sample, ";")
| mvexpand sample
| rex field=sample "\'(?<who>[^\']+)\'.+?(?<status>\w+)$"
| table who, status

Output:

[Tannawi_Chauha1]

may i know which version of splunk you are using.....

[javiergn]

Splunk Enterprise 6.4.1

[Tannawi_Chauha1]

mine is splunk 6.2.5....would it be reason of not showing the output??

[javiergn]

Could be the makeresults as I don't know when it was implemented, try this instead:

 | stats count | fields - count
 | eval sample = "
 'aaaa bbbb cccc dddd' (1234) is running;
 'akdg ytdf tyui tyhj' (1245) is running
 "
 | eval sample = split(sample, ";")
 | mvexpand sample
 | rex field=sample "\'(?<who>[^\']+)\'.+?(?<status>\w+)$"
 | table who, status

[Tannawi_Chauha1]

Thanks Javiergn.....this query really works. so stats is working in place of "makeresults".
Sorry for delay in response.

I want time should be one of the table column too in the output.

[javiergn]

Hi,

If you want time to be there too simply change the last line form:

| table who, status

To:

| table _time, who, status

By the way, once you are happy with the information provided, please don't forget to mark one of the answers here as answered in order to close this off and allow others to benefit from it.

Thanks,
J

[Tannawi_Chauha1]

I did that before putting this query. As it is sample event so the query not able to populate the _time column.

Is it possible to make this query a dynamic. Dynamic means query pick the "sample" from incoming events. As the "sample" make it static even if status will change it wont get reflect in the output.

Post that i think _time column would get populate with the value

[sundareshr]

Assuming these are individual events, try this.

*UPDATED based on real events*

your search | rex field=_raw "(?<device>[^\(]+)\(\d+\)\sis\s(?<status>\w+)" | table device status

[Tannawi_Chauha1]

didn't work

[sundareshr]

When say didn't work what do you mean. Were you able to go to the link I provided. That has the data and regex that shows how the fields have been captured. Are you saying that the fields are not captured correctly or that you were not able to get to the link?

[Tannawi_Chauha1]

i opened that link. I used the rex expression created by that online regex tool. When i used that expression in my search query no data is showing in output.

My query is is there any other reason that data is unable to extract from the event and get populate into the field.

[sundareshr]

As you can see in the online tool, the regex matches the data sample you provided.

The only reason I can think of is there's something that's getting lost when you're masking the data.

Did you try copying your data in the online tool to see if the regex works? If it doesn't, on the right of that page, you will see explanation, paste that over here.

OR

Can you share the actual event without modifying anything.

[Tannawi_Chauha1]

i have paste my data there it capture the right field.....i cnt paste my original data due to client data protection.

But when i used same in the search query its throwing no result found.

[sundareshr]

Can you share the query you are using. Without any changes.

[sundareshr]

@Tannawi.Chauhan try my updated answer