How to move multivalue fields as separate columns?

[fedejko]

Hi, I have the following case which I can't get around.

My search returns something like this:

In order to help security analysts with some useful information, from a lookup we are adding MITRE technique ID  and some useful information about how to detect this particular technique.

What I wanted to do is to move the multivalue fields from mitre_technique_id column as the separate columns named exactly like the MITRE ID, and in that column I wanted to include the information about the detection tips for that technique.

I was trying something with foreach, transpose, mvexpand but with no good results.

Does anyone knows how to achieve it? The end result would look like this:

Thanks in advance!

[somesoni2]

Give this a try

YOur current search giving field host, dest, user, mitre_technique_id mitre_detection
| eval iddetect=mvzip(mitre_technique_id,mitre_detection,"|")
| mvexpand iddetect
| rex field=iddetect "(?<mitre_technique_id>[^\|]+)\|(?<mitre_detection>.+)"
| fields - iddetect
| eval common_key=host."##".dest."##".user
| xyseries common_key mitre_technique_id mitre_detection
| rex field=common_key "(?<host>[^#]+)##(?<dest>.+)##(?<user>.+)"
| fields - common_key
| table host dest user *

[ITWhisperer · Accepted solution]

| streamstats count as row 
| eval iddetect=mvzip(mitre_technique_id,mitre_detection,"|")
| mvexpand iddetect
| rex field=iddetect "(?<_name>[^\|]+)\|(?<_value>.+)"
| eval {_name}=_value
| fields - iddetect mitre_technique_id mitre_detection
| stats values(*) as * by row
| fields - row

[fedejko]

Solved by adding (?s) in front of the regex.

[fedejko]

Thanks, I see the light in the tunnel 🙂

How to modify that regex so it captures remaining lines of the paragraph?

[ITWhisperer]

Try this

| rex field=iddetect "(?ms)(?<_name>[^\|]+)\|(?<_value>.+)"