How to organize values in Statistics search?

[ecm9210]

Hi, I have a blob of text in both the title and description file, I've tried looking for how to seperate them when I am seraching but I have not found anything. It looks like

Question? NoIf yes, Question? N/ADoes this even do something? N/AIs the event a false positive? YesTicket number: N/ASource Unique Identifier (UI): Alert trigger time: Date/time UTCEvent start time: Date/time

etc

I would like it to look like this
Question? No
If yes, Question? N/A
Does this even do something? N/A
Is the event a false positive? Yes
Ticket number: N/A
Source Unique Identifier (UI):

Alert trigger time: Date/time UTC
Event start time: Date/time

The search I'm using is this

| inputlookup append=t investigative_canvas_entries_lookup
| table _time creator owner title description canvas_id
| sort -_time

[DalJeanis · Accepted solution]

First, verify whether there is an unprintable character between "Question? No" and "If yes, Question?". If so, we will need to key on that to split the data.

If not, then the next question is, are the question stems always exactly the same wording, or a small set of alternatives? In that case, we can use a rex to extract them to individual fields using a regex such as one of the following....

...if you want the questions and answers each separate...

| rex field=myfield "(?<Q1>Question\?)\s*(?<A1>.*?)(?<Q2>If yes, Question\?)\s*(?<A2>.*?)(?<Q3>Does this even do something\?)\s*(?<A3>.*?)(?<Q4>Is the event a false positive\?)\s*(?<A4>.*?)(?<Q5>Ticket number:)\s*(?<A5>.*?)(?<Q6>Source Unique Identifier \(UI\):)\s*(?<A6>.*?)(?<Q7>Alert trigger time:)\s*(?<A7>.*?)(?<Q8>Event start time:)\s*(?<A8>.*)"

...if you want each question and answer as a unit ...

| rex field=myfield "(?<Q1>Question\?\s*.*?)(?<Q2>If yes, Question\?\s*.*?)(?<Q3>Does this even do something\?\s*.*?)(?<Q4>Is the event a false positive\?\s*.*?)(?<Q5>Ticket number:\s*.*?)(?<Q6>Source Unique Identifier \(UI\):\s*.*?)(?<Q7>Alert trigger time:\s*.*?)(?<Q8>Event start time:\s*.*)"