Extract field from table data which present on _raw

[sathim471]

Hi All,

I have below table type data in _raw and i want to extract fields.

Example _raw as below

Name       ID         Age

Harry        AAA     23

Will           BBB       27

Brian        CCC      30

Expectation is  like below. I want 3 fields (as no.of columns) and it should list like below. 

if i do (...|table Name,ID,Age) it should show like below

Name ID Age

Harry AAA 23

Will BBB 27

Brian CCC 30

Thanks in advance

[to4kawa]

index=_internal | head 1 | fields _raw | eval _raw="Name       ID         Age
Harry        AAA     23
Will           BBB       27
Brian        CCC      30"
| rename COMMENT as "these are your log sample. from here, the logic"
| rex mode=sed "s/[ ]+/,/g"
| multikv
| rename COMMENT as "as you like | table Name,ID,Age"

[inventsekar]

Hi @sathim471 .. these logs are already ingested or not yet? if they are ingested already, what is your current search query? the fields may be already extracted.. 

if so, ..lets say, for example:

index=main source=testSource | table Name ID Age

if fields are not extracted, then, you have to use "rex" (regular expressions)command to extract them. provide us some sample events, so that we can help you with rex query.