My log sample looks like this:
testServiceName,testTransName,DEVTEST,,,3375598402,15,754,5,2020-07-11 18:41:31.982,2020-07-11 18:41:32.271,29,,,,2,48,248,,,,162,9426,2192,,,,,,,,,,,test,|TxnMessage=SUCCESS|ErrMessage=No Error|PlNumber=testPl|src=testSrc|SrcId=1234_src1;1234_src2|TxnId=txn-A688|ParentId=|TransactionType=,
I need to extract a few fields in my table. Eg: PlNumber, Src, SrcId
I'm trying like the below:
<mysearch> ... | rex "SrcId=(?<SrcId>.*)" | table PlNumber, Src, SrcId
On the results, the SrcId column is concatenated with the other tail columns, like:
--------------------------------------------------------------
| PlNumber | Src | SrcId |
--------------------------------------------------------------
| testPl | testSrc | 1234_src1;1234_src2|TxnId=txn- |
| A688|ParentId=|TransactionType=, |
--------------------------------------------------------------
What I need:
-------------------------------------------------
| PlNumber | Src | SrcId |
-------------------------------------------------
| testPl | testSrc | 1234_src1;1234_src2 |
-------------------------------------------------
I know that my Regex is missing something.
Kindly help achieving this.
index=_internal |head 1 | fields _raw _time | eval _raw="testServiceName,testTransName,DEVTEST,,,3375598402,15,754,5,2020-07-11 18:41:31.982,2020-07-11 18:41:32.271,29,,,,2,48,248,,,,162,9426,2192,,,,,,,,,,,test,|TxnMessage=SUCCESS|ErrMessage=No Error|PlNumber=testPl|src=testSrc|SrcId=1234_src1;1234_src2|TxnId=txn-A688|ParentId=|TransactionType=,"
| extract pairdelim=",|" kvdelim="="
| table PlNumber, src, SrcId
try extract
index=_internal |head 1 | fields _raw _time | eval _raw="testServiceName,testTransName,DEVTEST,,,3375598402,15,754,5,2020-07-11 18:41:31.982,2020-07-11 18:41:32.271,29,,,,2,48,248,,,,162,9426,2192,,,,,,,,,,,test,|TxnMessage=SUCCESS|ErrMessage=No Error|PlNumber=testPl|src=testSrc|SrcId=1234_src1;1234_src2|TxnId=txn-A688|ParentId=|TransactionType=,"
| extract pairdelim=",|" kvdelim="="
| table PlNumber, src, SrcId
try extract
That works ! Thank you very much !