How to split a single line event into multiple events at search time?

[romaindelmotte]

Hi,

I have those kind of events indexed:

11/26/15 15:05:11.000 retrievePending=0 mergePending=1823 sendPending=43 resendPending=2

The numbers above are the count of pending tasks in different queues of an application.
Unfortunately, I cannot change the way the logs are written down in the log files, and wished it was something like this:

11/26/15 15:05:11.000 queue=retrieve pending=0
11/26/15 15:05:11.000 queue=merge pending=1823
11/26/15 15:05:11.000 queue=send pending=43
11/26/15 15:05:11.000 queue=resend pending=2

So, is there a way - at search time - to split my data into multiple events so I can use a by clause like below?

index=main sourcetype=queues host=web01 | timechart avg(pending) by queue

I've been looking for some time now, even playing with multi-value commands like mvzip, mkexpand, etc., but can't crack this one.

Any help would be appreciated.

Thanks,

Romain

[romaindelmotte · Accepted solution]

Just find a way myself, actually.

 index=main sourcetype=queues host=web01
| eval fields=mvappend("retrieve:".retrievePending,"merge:".mergePending,"send:".sendPending,"resend:".resendPending)
| mvexpand fields
| makemv delim=":" fields
| eval queue=mvindex(fields,0)
| eval count=mvindex(fields,1)
| eval ratio=round((count/500)*100, 2)
| timechart avg(ratio) by queue

Any way to make that a bit more efficient, though?

[fpavlovi]

It helped me as well, thank you for sharing!