The search result produces output of a column in following format
Wondering if it is possible to filter the output of these columns to have just the keys and not key=value pairs i.e. have output like
Take a look at the
rex command. There are multiple ways you could do it, but here's one:
| rex field=yourfield max_match=50 "(?<key_list>[A-Za-z]+)=" | eval newfield=mvjoin(key_list,",")
You'll end up with the result in the new field
key_list. Skip the second part if you want to keep it as a multi-valued field instead of merging them back into a single entry.
You will need to write a regex that matches your format, or possibly use the xpatch commands. Take a look at the docs for reg and xpath. If you use rex, you may want to try out Kodos or RegexBuddy to help you troubleshoot your regular expression.