array

[vinod0313]

Hello

I have log like below

FEATURES_USING=[tokenValidatorInfo=false, requestValidationRequired=false, requestPayloadValidationRequired=false, responsePayloadValidationRequired=false, aopUsed=false, tibcoCommunicatorUsed=false, secretsSecured=false]


I want result should be like below(should splitin 2 columns)

Column1                                                                                                   column2

tokenValidatorInfo                                                                                  false

requestValidationRequired                                                                false

requestPayloadValidationRequired                                                false

-----                                                                                                               ---

[ITWhisperer]

Hi @vinod0313 

An additional requirement to your previous question! here  and not a great leap to this:

| rex field=_raw "FEATURES_USING=\[(?<feature>.*)\]" 
| makemv delim=", " feature 
| mvexpand feature 
| rex field=feature "(?<Column1>[^=]*)=(?<column2>.*)"
| fields Column1,column2

[richgalloway]

See if this helps.

| makeresults | eval _raw="FEATURES_USING=[tokenValidatorInfo=false, requestValidationRequired=false, requestPayloadValidationRequired=false, responsePayloadValidationRequired=false, aopUsed=false, tibcoCommunicatorUsed=false, secretsSecured=false]" 
```Above is just to create test data```
| extract pairdelim="[,]", kvdelim="="
| fields - FEATURES_USING _raw _time _kv
| transpose 0 column_name="column1"
| rename "row 1" as column2

[richgalloway]

Thank you for not using "splunk" as the subject of this posting.  It would be better still to use more than a single word.  For example: "How to parse an array?"

What have to tried so far to solve this problem?