my event is below :
6|1|1|12|1907|1|1|1219079|1|1|126G|19079|1|1|12NB|190|1|1|126G774_100_NB|1907|1|1|126G|19079
sometimes A field will change the number as 5, 7, 8 like 5rows and 7 rows will come so that A is dynamic.
A | B | C | D | E |
6 | 1 | 1 | 650_3M | 1921 |
1 | 1 | 1758 | 749 | |
1 | 1 | 55 | 22 | |
1 | 1 | 55 | 33 | |
1 | 1 | 55 | 55 | |
1 | 1 | 55 | 66 |
Change the first rex to this
| rex "^(?:([^\|]+\|){4})(?<A>[^\|]+)(?<NotA>.*)"
I suspect the event you gave as an example is missing a pipe (and possibly data) between D and E in the second group and should have been?
6|1|1|12|1907|1|1|126G|19079|1|1|126G|19079|1|1|12NB|190|1|1|126G774_100_NB|1907|1|1|126G|19079
Assuming the missing pipe to be the case
| rex "(?<A>[^\|]+)(?<NotA>.*)"
| rex max_match=0 field=NotA "(?<BCDE>(\|[^\|]+){4})"
| mvexpand BCDE
| rex field=BCDE "\|(?<B>[^\|]+)\|(?<C>[^\|]+)\|(?<D>[^\|]+)\|(?<E>.+)"
thank you so much for quick response.
this is my sample events
|6|1|1|126G7|1907|1|1|126G7|19079|1|1|126G77|190795|1|1|126G7|190795|1|1|126G|1907|1|1|126G|1907
|7|1|1|126G7|19076|1|1|126G7|19079|1|1|126G77|190795|1|1|126G7|190795|1|1|126G|1907|1|1|126G|19078|1|1|126G7|19078|
i want output be like
6 | 1 | 1 | 650_3M | 1921 |
1 | 1 | 1758 | 749 | |
1 | 1 | 55 | 22 | |
1 | 1 | 55 | 33 | |
1 | 1 | 55 | 55 | |
1 | 1 | 55 | 66 | |
7 | 1 | 1 | 650_3M | 1921 |
1 | 1 | 1758 | 749 | |
1 | 1 | 55 | 22 | |
1 | 1 | 55 | 33 | |
1 | 1 | 55 | 55 | |
1 | 1 | 55 | 66 | |
1 | 1 | 55 | 66 | |
3 | 1 | 1 | 55 | 66 |
1 | 1 | 55 | 66 | |
1 | 1 | 55 | 66 |
Is the only difference the fact that A is repeated on the other rows? If so
| rex "(?<A>[^\|]+)(?<NotA>.*)"
| rex max_match=0 field=NotA "(?<BCDE>(\|[^\|]+){4})"
| mvexpand BCDE
| rex field=BCDE "\|(?<B>[^\|]+)\|(?<C>[^\|]+)\|(?<D>[^\|]+)\|(?<E>.+)"
| streamstats count as row by A
| eval A=if(row=1,A,null())
| fields - row
Thank you so much. It is very helpful.
If the event will be as below means
Abc|cbde1|elog|700|6|1|1|126G7|1907|1|1|126G7|19079|1|1|126G77|190795|1|1|126G7|190795|1|1|126G|1907|1|1|126G|1907
How can I slipt from |6 onwards.
Once again, thanks quick response.
Change the first rex to this
| rex "^(?:([^\|]+\|){4})(?<A>[^\|]+)(?<NotA>.*)"
Its working Awesome. Thank you so much 😊