Parsing comma separated values

[Scott Allison]

We're using a Syslog to get data to Log Analytics from some devices. This works perfectly and places the relevant data we need in the "Syslogmessage" column in "Syslog". I'm trying to use the parse command to extract that data into new columns but cannot figure out how to do it. Here is a sample of the value in that column:

37:00,0008C101547,SYSTEM,userid,0,2018/07/23 11:36:58,,connect-ldap-sever-failure,SERVER1.DOM1.DOMAIN1,0,0,general,medium,"ldap cfg CT Group Mapping failed to connect to server SERVER1.DOM1.DOMAINNAME.net:389: Error: Failed to get address info for SERVER1.DOM1.DOMAINNAME.net.",38678840,0x8000000000000000,0,0,0,0,,DOM1FHS01.LAB

I figured I could use regex to extract what I need, but cannot seem to get it to work correctly. What's the best way to do this?

Example of something I've tried:

Syslog

| parse kind=regex SyslogMessage with foo "^37:00,"

foo2 "(?ms),"

foo3 ".*,"

foo4 ","

foo5 "," *

| project foo , foo2 , foo3 , foo4 , foo5

[#2]

I found a way:

Syslog

| extend msgArr=split(SyslogMessage, ",")

| project Receive_Time=msgArr[0],

Serial_Number=msgArr[1],

Type=msgArr[2],

Subtype=msgArr[3],

FUTURE_USE1=msgArr[4],

Generated_Time=msgArr[5],

Virtual_System=msgArr[6],

Event_ID=msgArr[7],

Object=msgArr[8],

FUTURE_USE2=msgArr[9],

FUTURE_USE3=msgArr[10],

Module=msgArr[11],

Severity=msgArr[12],

Description=msgArr[13],

Sequence_Number=msgArr[14],

Action_Flags=msgArr[15],

Device_Group_Hierarchy_Level_1=msgArr[16],

Device_Group_Hierarchy_Level_2=msgArr[17],

Device_Group_Hierarchy_Level_3=msgArr[18],

Device_Group_Hierarchy_Level_4=msgArr[19],

Virtual_System_Name=msgArr[20],

Device_Name=msgArr[21]

 However, occasionally I have a Syslog message that comes in that has an extra comma in a field, which pushes the other columns over. Still trying to work through that.