How to make a loop in one event?

[sabinayang]

My log is like this:

Time	Event
3/23/22 11:00:00.000 AM	Application 'AAA' is running Application 'BBB' is stopped Database 'CCC' is running Database 'DDD' is running
3/23/22 11:10:00.000 AM	Application 'AAA' is running Application 'BBB' is running Database 'CCC' is stopped Database 'DDD' is running

I want to extract a table like

Time	Server	Host	Status
3/23/22 11:00:00.000 AM	Application	AAA	running
3/23/22 11:00:00.000 AM	Application	BBB	stopped
3/23/22 11:00:00.000 AM	Database	CCC	running
3/23/22 11:00:00.000 AM	Database	DDD	running
3/23/22 11:10:00.000 AM	Application	AAA	running
3/23/22 11:10:00.000 AM	Application	BBB	running
3/23/22 11:10:00.000 AM	Database	CCC	stopped
3/23/22 11:10:00.000 AM	Database	DDD	running

How to do this? If anyone has idea?

[ITWhisperer]

Is event a multivalue field - if so, use mvexpand to expand to multiple events, then you can extract server, host and status from the event field