Hi,
I want to separate out below fields in table format.
Raw = Namespace [com.sampple.ne.vas.events], ServiceName [flp-eg-cg], Version [0.0.1], isActive [true], AppliationType [EVENT]
Query I am using =
| eval Namespace=mvindex(split(mvindex(split(_raw, "Namespace "),1),"],"),1)
| eval ServiceName=mvindex(split(mvindex(split(_raw,"ServiceName "),1),"],"),0)
| eval Version=mvindex(split(mvindex(split(_raw,"Version "),1),"],"),0)
| stats latest(Namespace) as Namespace latest(ServiceName) as ServiceName latest(Version) as Version by host
| sort -Version
Expected result
Host | AppName | ServiceName | Version |
@hanks @richgalloway this help
| rex max_match=0 "(?<keyvalue>\w+\s\[[^\]]+)"
| mvexpand keyvalue
| rex field=keyvalue "(?<key>\w+)\s\[(?<value>[^\]]+)"
| eval {key}=value
| fields - keyvalue key value
| stats values(*) as * by _raw
Thanks @ITWhisperer
It would help to know what results your query returned and why those results aren't good enough.
I prefer the rex command for extracting fields. The regular expressions below look for the given keyword then extract what's between the following square brackets.
| rex "Namespace \[(?<Namespace>[^\]]+)"
| rex "ServiceName \[(?<ServiceName>[^\]]+)"
| rex "Version \[(?<Version>[^\]]+)"
| stats latest(Namespace) as Namespace latest(ServiceName) as ServiceName latest(Version) as Version by host
| sort -Version