i have a field with dates in single line ( could be many dates )
ex: 2019-04-11 23:15:58.547 2019-05-02 10:11:22.833 2019-05-03 10:21:27.0
need help to replace every 2nd space with carriage, so each date shows on a separate line when exported. right now they show on single line when exported.
Assuming, you need to do at Search Time, please find an example
|makeresults
| eval raw_data="2019-04-11 23:15:58.547 2019-05-02 10:11:22.833 2019-05-03 10:21:27.0"
| rex field=raw_data mode=sed "s/([\d\-]+)\s([\d\:\.]+)/\1 \2;/g"
|makemv delim=";" raw_data
|mvexpand raw_data
you may need to improve the regex based on your data
Assuming, you need to do at Search Time, please find an example
|makeresults
| eval raw_data="2019-04-11 23:15:58.547 2019-05-02 10:11:22.833 2019-05-03 10:21:27.0"
| rex field=raw_data mode=sed "s/([\d\-]+)\s([\d\:\.]+)/\1 \2;/g"
|makemv delim=";" raw_data
|mvexpand raw_data
you may need to improve the regex based on your data
Koshyk , thank you, using this code, i am able to see the data in a new line within the column. ( leaving the last line of code , ie |mvexpand raw_data as i want all data to be in single row )
But when i export, i dont see new line in the row, but all in same line with ; as delimiter.
can the same format be there when we export the file ?
Never mind, got it to work by doing below code.
|rex field=raw_data mode=sed "s/([\d-]+)\s([\d:.]+)/\1 \2;/g"
|makemv delim=";" raw_data
|rex field=raw_data mode=sed "s/;/\n/g"
First 2 lines are from what you gave, then i changed the ; delimiter back to new line on the 3rd line.
this ensures, i can see the records in new line on the report page and also shows as new lines when i export them to xls/csv
thanks
great to know it worked. cheers