create a multivalue field, based on multiple single value fields with the same field name

[fsiemons]

Hi there, I have a bit of a tough one.

I have a log with multiple entries of the same field, basically a list of values. I am trying to merge these values into a single new field, with a line for every value that was in the RAW event.

An example:

2020-07-21T01:52:37+00:00 devicename=device1 | id=a522131 | date=2020-07-21T01:51:20 | name=peter | score=5 | action=read | randomfield1=nothingimportant | score=2 | action=read | score=2 | action=write | score=2 | action=write | randomfield2=nothingimportant

The intended resulting table where "actions" is a mv field, listing all actions (merging "score" and "action" as well), each on a line, but within the single field (actions):

name=peter
actions=
5:read
2:read
2:write
2:write

[richgalloway]

See if this helps.

| makeresults | eval _raw="2020-07-21T01:52:37+00:00 devicename=device1 | id=a522131 | date=2020-07-21T01:51:20 | name=peter | score=5 | action=read | randomfield1=nothingimportant | score=2 | action=read | score=2 | action=write | score=2 | action=write | randomfield2=nothingimportant"
```Above just creates test data```
| rex "\bname=(?<name>\w+)" 
| rex max_match=0 "score=(?<score>\d+)" 
| rex max_match=0 "action=(?<action>\w+)"
| eval actions=mvzip(score, action, ":")
| table name actions