How to develop a table based on my CSV log format?

[balleste]

I have the following log format and I'm trying to create a table that will have the following format:

"Device","Object","Value" "mail01","Analyzed attachment count","100 #" "mail02","Analyzed attachment count","3 #" "mail03","Analyzed attachment count","300 #" "mail04","Analyzed attachment count","25 #" "mail05","Analyzed attachment count","1000 #"

|Device | Object | Value |
|mail01 | Analyzed attachment count | 100 |
|mail02 | Analyzed attachment count | 3 |
|mail03 | Analyzed attachment count | 300 |
|mail04 | Analyzed attachment count | 25 |
|mail05 | Analyzed attachment count | 1000 |

Any ideas?

[somesoni2]

Try like this

your base search to select that event | rex max_match=0 "\"(?<Device>[^\"]+)\",\"(?<Object>[^\"]+)\",\"(?<Value>\d+)\s+#\"" | eval temp=mvzip(mvzip(Device,Object,"#"),"#")  | mvexpand temp | rex field=temp "(?<Device>.+)#(?<Object>.+)#(?<Value>\d+)" | table Device Object Value

[balleste]

Thanks for the response...I ran it but I get an error with the eval command stating that the arguments of the mvzip command is invalid.