How to retrieve multiple values of a single field in a single table row?

[Nidd]

I have a few logs in this format:

|preferenceDetails:-preferenceType=BILL_NOTIFICATION,preferenceAction=OPT_IN,preferenceEligible=True|preferenceType=POLICY_DOCUMENTS,preferenceAction=OPT_IN,preferenceEligible=True| 

Where preferenceDetails is a list and there could be a number of preferenceType, preferenceAction, preferenceEligible within it.

Can I obtain a result in this format? :

-----------------------------------------------------------
      preferenceType_preferenceAction_preferenceEligible
-----------------------------------------------------------
BILL_NOTIFICATION_OPT_IN_True, POLICY_DOCUMENTS_OPT_IN_True
-----------------------------------------------------------

i.e. I wish to have values separated by '_' and records separated by ','.

[niketn · Accepted solution]

@Nidd, can you explain with example of field and value based on above data as to what they would be after finding values and separating field and values.

You can use extract command with raw data i.e. `| extract pairdelim="," kvdelim=""`. Following is a run anywhere search based on your data.

| makeresults 
| eval _raw="|preferenceDetails:-preferenceType=BILL_NOTIFICATION,preferenceAction=OPT_IN,preferenceEligible=True|preferenceType=POLICY_DOCUMENTS,preferenceAction=OPT_IN,preferenceEligible=True|"
| extract pairdelim="," kvdelim="_"

Or you can try the following rex command

| makeresults 
| eval _raw="|preferenceDetails:-preferenceType=BILL_NOTIFICATION,preferenceAction=OPT_IN,preferenceEligible=True|preferenceType=POLICY_DOCUMENTS,preferenceAction=OPT_IN,preferenceEligible=True|"
| rex "=(?<key>\w+)_(?<value>[^,]+)," max_match=0

[Nidd]

Modified your 2nd query a little and it worked fine Niketnilay ! Thanks a lot for your effort 🙂