How to extract a csv data fields message data into fields?

[Cheng2Ready]

I have a field message that when
I run the search

index=example123 host=5566
|search "*specials word*"
I table message

it displays as an example below: 

2024-08-02 16:45:21- INFO Example (['test1' , 'test2', 'test3', 'test4', 'test5', 'test6', 'test7)'] , ['Medium', 'Large ', 'Small', 'Small ', 'Large ', 'Large ', 'Large '])

Is there a way to run a command so that the data in the field "Message"  can be extracted into their own fields or displayed like this matching 1:1 on a table 



test1           test2       test3        test4         test5           test6          test7
Medium     Large      Small        Small         Large        Large          Large

or

test1 = Medium 
test2= Large 
test3 = Small
.... ect

[ITWhisperer · Accepted solution]

Assuming your real events don't have brackets in the names, try something like this

| rex "Example \(\[(?<keys>[^\]]*)\]\s*,\s*\[(?<values>[^\]]*)\]\)"
| rex max_match=0 field=keys "'(?<key>[^']+)'"
| rex max_match=0 field=values "'(?<value>[^']+)'"
| table key value
| eval pairs=mvzip(key, value, "=")

[Cheng2Ready]

I think I found the answer
| rex field="Example" seemed to work

Thank you

[ITWhisperer]

It is often quicker if you give accurate representations of your real data, not just made up names, but good that you worked out how to fix it.

[Cheng2Ready]

Thank you for your prompt response
I have different container names
example replacing

'test1' , 'test2', 'test3', 'test4', 'test5', 'test6', 'test7

to as an example

'x99_846' , 'beacon score', 'account count', '', 'credit_transactions', 'status_active_years', 'current'

ect

[ITWhisperer]

Does the search work for you?

[Cheng2Ready]

partially 
Where we had "Example"
It can sometimes be other words
so its not capturing everything from  ([