topic Display table with field values having spaces in Dashboards & Visualizations

Display table with field values having spaces

Nidd — Thu, 31 Oct 2019 13:20:56 GMT

I have a field named Source which contains spaces.
eg:

index=myIndex |Source=My Source Value|ComponentValue=My Component Value

To make this field displayed in a table, I used the following command.

rex "Source=(?<Source>[\S\s]*),{15}"

For which, I get

-----------------------
Source
-----------------------
My
My Source Value
My
My

If I'm doing like:

rex "Source=(?<Source>[\S\s]*)" | table Source | rename Source as source

I get the value I require, but also the entire log as well.

i.e:

-----------------------
Source
-----------------------
My Source Value
index=myIndex |Source=My Source Value|ComponentValue=My Component Value

My Source Value
index=myIndex |Source=My Source Value|ComponentValue=My Component Value

Can someone please help how to achieve this?

Re: Display table with field values having spaces

kamlesh_vaghela — Thu, 31 Oct 2019 14:00:57 GMT

@Nidd

Try | rex "Source=(?<Source>[\S\s]*)\|"

Example:

| makeresults 
| eval _raw=" index=myIndex |Source=My Source Value|ComponentValue=My Component Value" 
| rex "Source=(?<Source>[\S\s]*)\|"

Re: Display table with field values having spaces

arjunpkishore5 — Thu, 31 Oct 2019 14:24:53 GMT

Are you trying to extract the value of Source from the following text ? "|Source=My Source Value|ComponentValue=My Component Value" If yes, use this

| rex field=_raw "Source=(?<Source>[^|]+)"

Hope this helps.

Cheers