How to split the result of max_match?

[haiweichen]

The values I need are located in the field "msg". Each msg contains 3 records. I run this query and get the result as below,

index=summary | search msg="*blablabla*"
| rex max_match=3 "Type=(?<Type>.+?)\,"
| rex max_match=3 "Restaurant=(?<Restaurant>.+?)\,"
| rex max_match=3 "Date=(?<Date>.+?)\,"
| rex max_match=3 "status=(?<status>.+?)\,"
| table Date, Restaurant, Type, status

Date Restaurant Type Status

2021-03-10 2022-01-04 2021-05-01	Domino SOUTHERN RESTAURANTS TRUST MCDONALD'S	A B A	NEW USED USED
2021-03-11 2021-03-12 2022-02-05	KFC Domino MCDONALD'S	C B A	NEW NEW USED
2021-03-11 2021-12-20 2021-05-09	Rooster CYREN BAR MCDONALD'S	A A B	NEW USED USED
2021-03-12 2021-12-18 2021-06-22	Helo KFC MCDONALD'S	A A B	NEW USED USED
2021-03-12 2022-01-05 2022-01-14	KFC MCDONALD'S MCDONALD'S	A A B

The question is, how can I make each record separated? I would like to use query "where restaurant=KFC" to look for specific restaurant.

[ITWhisperer · Accepted solution]

index=summary | search msg="*blablabla*"
| rex max_match=3 "Type=(?<Type>.+?)\,"
| rex max_match=3 "Restaurant=(?<Restaurant>.+?)\,"
| rex max_match=3 "Date=(?<Date>.+?)\,"
| rex max_match=3 "status=(?<status>.+?)\,"
| eval row=mvzip(mvzip(Date,Restaurant,"|"),mvzip(Type,status,"|"),"|")
| mvexpand row
| eval Date=mvindex(split(row,"|"),0)
| eval Restaurant=mvindex(split(row,"|"),1)
| eval Type=mvindex(split(row,"|"),2)
| eval status=mvindex(split(row,"|"),3)
| table Date, Restaurant, Type, status

[haiweichen]

That's great! It works for my case.