how to reassign/move values ​​in other fields ?

[mah]

Hi,

I have a table like that : 

id	name	app	env
123	test1	[app]:my_app	[env]:my_env
456	test2	[env]:my_env	[app]:my_app

My issue is  is that the values ​​of the header env and app are mixed ...
How to put [app] values ​​in "app" column and [env] values ​​in "env" column ?

Is this possible ?

Thanks !

[richgalloway]

It looks like the data was not onboarded properly.  Specifically, the fields were not parsed correctly so data sometimes ended up in the wrong fields.

Can you share some raw events and the props.conf and transforms.conf settings used to ingest them?

[mah]

it seems I have to improve my script, because raws are formated by the script and directly push in a csv. 

I do not index the csv. I run my script on the Search Head. 

[to4kawa · Accepted solution]

| makeresults
| eval _raw="id	name	app	env
123	test1	[app]:my_app	[env]:my_env
456	test2	[env]:my_env	[app]:my_app"
| multikv forceheader=1
| table id	name	app	env
| eval tmp=id."#".name
| fields - id name
| untable tmp app env
| rex field=env "\[(?<app>\w+)\]"
| xyseries tmp app env
| rex field=tmp "(?<id>\d+)#(?<name>\w+)"
| table id name app env

[mah]

Perfect ! 

I did not have the logic to do that. 

Thank a lot !