Hi,
I would like to do a transformation like this:
Can you help how to achieve this?
Thanks in advance
Heinz
Try something like this
Your current search giving table 1 | eval temp=name."#".department | fields - name department | untable temp month project | rex field=temp "(?<name>.*)#(?<department>.*)" | table name department month project
Try something like this
Your current search giving table 1 | eval temp=name."#".department | fields - name department | untable temp month project | rex field=temp "(?<name>.*)#(?<department>.*)" | table name department month project
Awesome, thanks a lot!
Can you share the query for the first table
Unfortunately the first table would be the result of a csv