Extract multiple name value pairs from a field

[jbax]

Hello,

I have a field that contains the string below. 

a) There can be fewer/more than the 4 events listed below.  

b) Value of the events will be different.

(event=aa)(event=bb)(event=cc)(event=normal)

=====================================================

1) How can I create a new field events that equals "aa,bb,cc,normal"?

2) Is there a way to exclude the normal event?  So field events = "aa,bb,cc" only? 

3) Is there a way to make it list like so I can filter on these events values?  (ie - potentially count # of events with aa or cc or (aa + cc)?) 

4) Is there a way to count the events returned in the field?  

Thank you!

[renjith_nair · Accepted solution]

@jbax,

Try regex

|rex field=events max_match=0 "event=(?<EVENTS>.+?)\)"

From the result, you can do rest of the stats

Sample data

|makeresults|eval events="(event=aa)(event=bb)(event=cc)(event=normal) (event=xx)(event=yy)(event=zz)(event=normal)"|makemv events|mvexpand events|streamstats count as uniqueField
|rex field=events max_match=0 "event=(?<EVENTS>.+?)\)"
|eval Total=mvcount(EVENTS)
|stats count as event_count,max(Total) as Total by EVENTS,uniqueField

Let's know your final output format. We can fine tune w.r.t count and total

[jbax]

@renjith_nair 

Thanks, this worked well for me!   Would you know of a way to exclude values (ie - normal)?  

Thank you!

[renjith_nair]

Sure. Just add this after the rex command

|eval EVENTS=mvfilter(!match(EVENTS,"normal"))