My log sample looks like this: testServiceName,testTransName,DEVTEST,,,3375598402,15,754,5,2020-07-11 18:41:31.982,2020-07-11 18:41:32.271,29,,,,2,48,248,,,,162,9426,2192,,,,,,,,,,,test,|TxnMessage=SUCCESS|ErrMessage=No Error|PlNumber=testPl|src=testSrc|SrcId=1234_src1;1234_src2|TxnId=txn-A688|ParentId=|TransactionType=, I need to extract a few fields in my table. Eg: PlNumber, Src, SrcId I'm trying like the below: <mysearch> ... | rex "SrcId=(?<SrcId>.*)" | table PlNumber, Src, SrcId On the results, the SrcId column is concatenated with the other tail columns, like: --------------------------------------------------------------
| PlNumber | Src | SrcId |
--------------------------------------------------------------
| testPl | testSrc | 1234_src1;1234_src2|TxnId=txn- |
| A688|ParentId=|TransactionType=, |
-------------------------------------------------------------- What I need: -------------------------------------------------
| PlNumber | Src | SrcId |
-------------------------------------------------
| testPl | testSrc | 1234_src1;1234_src2 |
------------------------------------------------- I know that my Regex is missing something. Kindly help achieving this.
... View more