Rex for cef event and create field alias accordingly

[ritikaviavi]

sample CEF:

May 20 20:44:51 10.XX.XX.XX May 20 2019 20:44:51 avcm02.com CEF:0|AV|Control Manager|7.0|BM:1000|Behavior Monitoring|3|rt=May 20 2019 03:34:47 GMT+00:00 dvchost=AV1 cn1Label=Risk_Level cn1=1 cs2Label=Policy cs2=1000 sproc=C:\\Windows\\System32\\taskeng.exe cn2Label=Event_Type cn2=1 cs1Label=Target cs1=C:\\Windows\\system32\\wscript.exe act=3 cn3Label=Operation cn3=101 shost=229Y9G2 src=10.XX.XX.XX deviceFacility=OfficeScan

Our AV is forwarding multiple types of events, in the above mentioned "Behavior Monitoring " events, I want to convert the corresponding shost to field dhost .
How should I place it in props/transforms ?

[venkasplunk]

U can try like this

"CEF" | extract pairdelim="{ }" kvdelim="=" | table shost src cs1

[venkasplunk]

Can provide some more information so that i will try to give some pointers?

U can try like this

"CEF" | extract pairdelim="{ }" kvdelim="=" | table shost src cs1