Is there a makemv to mvexpand command issue in my search?

[rdownie]

When running this search (the return value is hard coded, it is coming from an external command). I just pasted the results in the eval. It shouldn't make a difference.
Search:

|makeresults | eval return="1496410321;A;B# 1496410321;C;D# 1496410321;D;F# 1496413441;G;H# 1496413921;I;J# 1496413935;K;L#" |makemv delim="#" return | mvexpand return | rex field=return "(?P[^;]+);(?P[^;]+);(?P[^;]+)"  | eval dsrv_time=dsrv_timestamp | convert ctime(dsrv_time) | 
 table dsrv_timestamp,dsrv_time,dsrv_host,dsrv_file_name

The convert ctime(dsrv_timestamp) only works on the first event? Why is it not acting on each event?

dsrv_timestamp      dsrv_time       dsrv_host       dsrv_file_name  
1496410321  06/02/2017 09:32:01         A                 B
1496410321                             C                D
1496410321                             D                F
1496413441                             G                H
1496413921                             I                J
1496413935                             K                L

Any help with this would be appreciated.
Thanks

[micahkemp · Accepted solution]

There's a space after your # delimiter, which is throwing off your timestamp calcs. Try this:

| makeresults 
| eval return="1496410321;A;B# 1496410321;C;D# 1496410321;D;F# 1496413441;G;H# 1496413921;I;J# 1496413935;K;L#" 
| makemv delim="#" return 
| mvexpand return 
| rex field=return "\s*(?P<dsrv_timestamp>[^;]+);(?P<dsrv_host>[^;]+);(?P<dsrv_file_name>[^;]+)" 
| eval dsrv_time=dsrv_timestamp 
| convert ctime(dsrv_time) 
| table dsrv_timestamp,dsrv_time,dsrv_host,dsrv_file_name

[rdownie]

Ugh!! I banged my head on this for a while. Thanks!!!!!!!