Replace every 2nd pattern with carriage.

[jiaqya]

i have a field with dates in single line ( could be many dates )

ex: 2019-04-11 23:15:58.547 2019-05-02 10:11:22.833 2019-05-03 10:21:27.0

need help to replace every 2nd space with carriage, so each date shows on a separate line when exported. right now they show on single line when exported.

[koshyk · Accepted solution]

Assuming, you need to do at Search Time, please find an example

|makeresults 
| eval raw_data="2019-04-11 23:15:58.547 2019-05-02 10:11:22.833 2019-05-03 10:21:27.0"
| rex field=raw_data mode=sed "s/([\d\-]+)\s([\d\:\.]+)/\1 \2;/g"
|makemv delim=";" raw_data
|mvexpand raw_data

you may need to improve the regex based on your data

[jiaqya]

Koshyk , thank you, using this code, i am able to see the data in a new line within the column. ( leaving the last line of code , ie |mvexpand raw_data as i want all data to be in single row )

But when i export, i dont see new line in the row, but all in same line with ; as delimiter.

can the same format be there when we export the file ?

[jiaqya]

Never mind, got it to work by doing below code.

|rex field=raw_data mode=sed "s/([\d-]+)\s([\d:.]+)/\1 \2;/g"

|makemv delim=";" raw_data
|rex field=raw_data mode=sed "s/;/\n/g"

First 2 lines are from what you gave, then i changed the ; delimiter back to new line on the 3rd line.
this ensures, i can see the records in new line on the report page and also shows as new lines when i export them to xls/csv

thanks

[koshyk]

great to know it worked. cheers