I have list of events that was able to tabulate it as
Id | LOG
---------------
1 | A:message1
1 | B: notification2
2 | A:message3
2 | B: notification4
I need to split LOG and then those row based in ID
id | message | notification
-----------------------------------------
1 | A: message1 | B: notification2
2 | A: message3 | B: notification4
| eval message=if(like(LOG,"%message%"),LOG,null())
| eval notification=if(like(LOG,"%notification%"),LOG,null())
| stats values(message) as message values(notification) as notification by Id