Field Extraction

[ReachDataScient]

If the event has field names and values both separated by pipe, how to do field extraction.

Field1|Value1|Field2|Value2|Field3|Value3...........

[anjambha]

Hi,

Try This run search anywhere

| makeresults | eval data="Field1|Value1|Field2|Value2|" | rex field=data "Field1\|(?<Field1>\w+)\|Field2\|(?<Field2>\w+)\|"

or

base search |  rex field=data "Field1\|(?<Field1>\w+)\|Field2\|(?<Field2>\w+)\|"