Group together different fields found on different lines, based on a common field

[RecoMark0]

Hello,
I would like to group together different fields found on different lines, based on a common field that is found on all lines.

Example Log Lines

2014-03-25 13:45:38,003 - [123456789] Incoming Search Request: project=Project01

2014-03-25 13:45:38,003 - [123456789] count=456, executionTime=334



2014-03-25 13:47:31,012 - [987654321] Incoming Search Request: project=Project02

2014-03-25 13:47:31,012 - [987654321] count=8784, executionTime=1145

I would like to create a table from these lines that looks like:

Project	ID	count	executionTime
Project01	123456789	456	334
Project02	987654321	8784	1145

Is this possible? The only examples I have found, the values to group are always on every line, where as some of my fields only appear on the first or second line.

[somesoni2 · Accepted solution]

Try this

your base search | transaction ID startswith="project=*" endswith="executionTime=*" | table project, ID, count,executionTime

[RecoMark0]

Awesome! That worked perfectly. Thank you!

[RecoMark0]

I have seen as many as 9 lines for a unique ID, but usually it is only 2 or 3 lines

[somesoni2]

For one ID, is there only two events or there can be more?