How do I break the one row into multiples rows in a table?

[Mrig342]

Hi All,

I  have below logs in one event:

AMQ8450I: Display queue status details.
QUEUE(ECS.AU.TO_KAFKA_RES.LISTEN) TYPE(QUEUE)
CURDEPTH(0) LGETTIME(00.28.06)
LPUTTIME(00.28.06)
AMQ8450I: Display queue status details.
QUEUE(ECS.HK.TO_KAFKA_RES.LISTEN) TYPE(QUEUE)
CURDEPTH(0) LGETTIME(01.32.35)
LPUTTIME(01.32.35)
AMQ8450I: Display queue status details.
QUEUE(ECS.ID.TO_KAFKA_RES.LISTEN) TYPE(QUEUE)
CURDEPTH(0) LGETTIME(01.26.46)
LPUTTIME(01.26.46)
AMQ8450I: Display queue status details.
QUEUE(ECS.MY.TO_KAFKA_RES.LISTEN) TYPE(QUEUE)
CURDEPTH(0) LGETTIME(01.38.02)
LPUTTIME(01.38.02)
AMQ8450I: Display queue status details.
QUEUE(ECS.PH.TO_KAFKA_RES.LISTEN) TYPE(QUEUE)
CURDEPTH(0) LGETTIME(23.12.07)
LPUTTIME(23.12.07)
AMQ8450I: Display queue status details.
QUEUE(ECS.SG.TO_KAFKA_RES.LISTEN) TYPE(QUEUE)
CURDEPTH(0) LGETTIME(01.39.26)
LPUTTIME(01.39.26)
AMQ8450I: Display queue status details.
QUEUE(ECS.TH.TO_KAFKA_RES.LISTEN) TYPE(QUEUE)
CURDEPTH(0) LGETTIME(01.28.20)
LPUTTIME(01.28.20)
AMQ8450I: Display queue status details.
QUEUE(ECS.VN.TO_KAFKA_RES.LISTEN) TYPE(QUEUE)
CURDEPTH(0) LGETTIME(21.47.43)
LPUTTIME(21.47.43)

I tried to create a table out of the data using the query:

*** | rex field=_raw max_match=0 "QUEUE\((?P<Queue_Name>[^\)]+)\)" | rex field=_raw max_match=0 "CURDEPTH\((?P<Cur_Depth>[^\)]+)\)" | rex field=_raw max_match=0 "LGETTIME\((?P<Get_Time>[^\)]+)\)" | rex field=_raw max_match=0 "LPUTTIME\((?P<Put_Time>[^\)]+)\)" | table Queue_Name,Cur_Depth,Get_Time,Put_Time

But the table comes out as below:

Queue_Name	Cur_Depth	Get_Time	Put_Time
ECS.AU.TO_KAFKA_RES.LISTEN ECS.HK.TO_KAFKA_RES.LISTEN ECS.ID.TO_KAFKA_RES.LISTEN ECS.MY.TO_KAFKA_RES.LISTEN ECS.PH.TO_KAFKA_RES.LISTEN ECS.SG.TO_KAFKA_RES.LISTEN ECS.TH.TO_KAFKA_RES.LISTEN ECS.VN.TO_KAFKA_RES.LISTEN	0 0 0 0 0 0 0 0	00.28.06 01.32.35 01.26.46 01.38.02 23.12.07 01.39.26 01.28.20 21.47.43	00.28.06 01.32.35 01.26.46 01.38.02 23.12.07 01.39.26 01.28.20 21.47.43

The problem here is that all the data is coming up in one row only. I tried "mvexpand" command to split up in individual rows but failed to do so.

Please help to modify the query to make the output table come as one row per line.

Thank All..!!

[ITWhisperer · Accepted solution]

| eval row=mvrange(0,mvcount(Queue_Name)) 
| mvexpand row
| foreach *_*
    [| eval <<FIELD>>=mvindex(<<FIELD>>,row)]
| fields - row

[Mrig342]

Thank you very much @ITWhisperer ...!! That works really fine..