If the event has field names and values both separated by pipe, how to do field extraction.
Field1|Value1|Field2|Value2|Field3|Value3...........
Hi,
Try This run search anywhere
| makeresults | eval data="Field1|Value1|Field2|Value2|" | rex field=data "Field1\|(?<Field1>\w+)\|Field2\|(?<Field2>\w+)\|"
or
base search | rex field=data "Field1\|(?<Field1>\w+)\|Field2\|(?<Field2>\w+)\|"
