Combine stats across multiline events

[hulahoop]

How can I get stats by author if I have multiline events like the below?

Project: /a/b/c
  loc=100 author=aaa@foo.com
  loc=100 author=bbb@foo.com
  loc=100 author=ccc@foo.com

Project: /a/b/c
  loc=200 author=aaa@foo.com
  loc=200 author=ccc@foo.com
  loc=200 author=ddd@foo.com

Given the 2 events above, am looking for a results table like this:

Project   Author         Total Lines of Code (loc)
-------------------------------------------------
/a/b/c    aaa@foo.com    300
          bbb@foo.com    100 
          ccc@foo.com    300
          ddd@foo.com    200

[martin_mueller · Accepted solution]

You could do something like this:

... | rex "Project:\s+(?<project>\S+)" | rex max_match=0 "(?<loc_author>loc=\d+\s+author=\S+)" | mvexpand loc_author | rex field=loc_author "loc=(?<loc>\d+)\s+author=(?<author>\S+)" | stats sum(loc) by project author

Make sure that doesn't clash with a potentially auto-extracted first set of loc/author fields.

[hulahoop]

Thank you, Martin! mvexpand is magical. 🙂