Try like this (run anywhere sample, replace first 2 line with your search, and update the field names per yours)
| gentimes start=-1 | eval temp="/ABCD/Safe+Alert+-+ABCD+failure Date: Jun 01,2017##/ABCD / Safe +Alert+-+Xyjw%28s%29+not+working Date: Jun 21,2017" | table temp | makemv temp delim="##" | mvexpand temp
| eval temp=urldecode(temp) | rex field=temp "Alert\s*-\s*(?<YourField>[^\:]+)"
Updated Answer
| gentimes start=-1 | eval temp="/ABCD/Safe+Alert+-+ABCD+failure Date: Jun 01,2017##/ABCD / Safe +Alert+-+Xyjw%28s%29+not+working Date: Jun 21,2017" | table temp | makemv temp delim="##" | mvexpand temp
| eval temp=urldecode(temp) | rex field=temp "Alert\s*-\s*(?<YourField>.+)\sDate\:"
Like this:
|makeresults |eval raw="/ABCD/Safe+Alert+-+ABCD+failure Date: Jun 01,2017
/ABCD / Safe +Alert+-+Xyjw%28s%29+not+working Date: Jun 21,2017"
| makemv delim="
" raw
| mvexpand raw
| rename raw AS _raw
| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"
| eval output=_raw
| rex field=output mode=sed "s%^/([^/]+)/(?:[^+]*\+){4}(.*) Date.*$%\1 \2% s/\+/ /g"
Hi I have already tried your solution but output for second line is
"ABCD not working" where as I was expecting "Xyjw not working"
ARGH! I grabbed the wrong ABCD
! I will update; hang on...
Try like this (run anywhere sample, replace first 2 line with your search, and update the field names per yours)
| gentimes start=-1 | eval temp="/ABCD/Safe+Alert+-+ABCD+failure Date: Jun 01,2017##/ABCD / Safe +Alert+-+Xyjw%28s%29+not+working Date: Jun 21,2017" | table temp | makemv temp delim="##" | mvexpand temp
| eval temp=urldecode(temp) | rex field=temp "Alert\s*-\s*(?<YourField>[^\:]+)"
Updated Answer
| gentimes start=-1 | eval temp="/ABCD/Safe+Alert+-+ABCD+failure Date: Jun 01,2017##/ABCD / Safe +Alert+-+Xyjw%28s%29+not+working Date: Jun 21,2017" | table temp | makemv temp delim="##" | mvexpand temp
| eval temp=urldecode(temp) | rex field=temp "Alert\s*-\s*(?<YourField>.+)\sDate\:"
Output is "ABCD failure Date", I need output without "Date", any suggestion?
Try the updated answer.
Try the updated answer by @somesoni2 😆
Try my answer.