Multiple occurrences of fields

[lain179]

Hello,

I have log lines that look like this [ some silly example but the idea is there 🙂 ]

mm/dd/yyyy hh:mm:ss - fruit: apple count: 5 price: $4 fruit: orange count: 10 price: $10

mm/dd/yyyy hh:mm:ss - fruit: banana count: 2 price: $1 fruit: orange count: 10 price: $10 fruit: pear count: 8 price: $14

mm/dd/yyyy hh:mm:ss - fruit: pineapple count: 10 price: $40 fruit: mango count: 1 price: $1

mm/dd/yyyy hh:mm:ss - fruit: coconut count: 5 price: $8 fruit: apple count: 5 price: $1

I know how to use rex to grab the fruit, count and price values from each line. There will be variable number of pairs of those values. How do I display the information for apple only using stats or anything by date?

In my example, only first and last log lines have apple in them. I want to display the count and price of apple for those two dates.

Appreciate any help.

[somesoni2]

As you said you're able to get the fruit, count and price for each line and since they repeat within same event as well, they are multivalued field. try this.

your base search + rex, giving _time, fruit(mvfield), count,price | eval fruitline=mvzip(fruit,count) | eval fruitline=mvzip(fruitline,price) | table _time, fruitline | mvexpand fruitline | rex field=fruitline "(?<fruit>.*),(?<count>.*),(?<price>.*)"| table _time fruit count price | where fruit="apple"