I have a log events that looks like this...
"name|fname|desc|group|cat|exp|set|in abc|abc||Administrators;Users|S||1|1 bbb|bbb|Internal||N||2|2
ccc|ccc|MFT Service ID|Administrators;Users|S||3|3"
the log event's text is delimited by 6 spaces...
What splunk query do I use to create splunk table like this
name | fname | desc | group | cat | exp | set | in |
abc | abc | Administrators;Users | S | 1 | 1 | ||
bbb | bbb | Interna | N | 2 | 2 | ||
ccc | ccc | MFT Service ID | Administrators;Users | S | 3 | 3 |
Agree with @PickleRick that you need to clearly demonstrate raw data because the I don't think your raw log looks like what you show. Is it more like the following?
name|fname|desc|group|cat|exp|set|in
abc|abc||Administrators;Users|S||1|1
bbb|bbb|Internal||N||2|2
ccc|ccc|MFT Service ID|Administrators;Users|S||3|3
In other words, it is multiline pipe (|) delimited text with a header line. (Like default table list from many SQL DBMS's.) The format shown in your original description cannot be reliably processed.
If my speculation about your raw data is correct, you first change delimiter to comma, then use multikv to extract from the table, like this:
| rex mode=sed "s/\|/,/g"
| multikv forceheader=1
| table name fname desc group cat exp set in
Here is an emulation for you to play with and compare with real data:
| makeresults
| fields - _time
| eval _raw = "name|fname|desc|group|cat|exp|set|in
abc|abc||Administrators;Users|S||1|1
bbb|bbb|Internal||N||2|2
ccc|ccc|MFT Service ID|Administrators;Users|S||3|3"
``` data emulation above ```
Output from this emulation is
name | fname | desc | group | cat | exp | set | in |
abc | abc | Administrators;Users | S | 1 | 1 | ||
bbb | bbb | Internal | N | 2 | 2 | ||
ccc | ccc | MFT Service ID | Administrators;Users | S | 3 | 3 |
Table is just a method of visualizing data. You need to parse your data into fields.
So the question is what the real data looks like (please copy-paste the raw event into a code block or a preformatted paragraph) and what it means. For now you have a lot of pipe-delimited "fields" but no way of knowing which of them are the "header", which are "data" and how many of "data" rows are there.