mutlivalue text into real table

[duncanzhang1]

I have a log events that looks like this...

"name|fname|desc|group|cat|exp|set|in abc|abc||Administrators;Users|S||1|1 bbb|bbb|Internal||N||2|2
ccc|ccc|MFT Service ID|Administrators;Users|S||3|3"

the  log event's text is delimited by 6 spaces...

What splunk query do I use to create splunk table like this

name	fname	desc	group	cat	exp	set	in
abc	abc		Administrators;Users	S		1	1
bbb	bbb	Interna		N		2	2
ccc	ccc	MFT Service ID	Administrators;Users	S		3	3

[yuanliu]

Agree with @PickleRick that you need to clearly demonstrate raw data because the I don't think your raw log looks like what you show.  Is it more like the following?

name|fname|desc|group|cat|exp|set|in
abc|abc||Administrators;Users|S||1|1
bbb|bbb|Internal||N||2|2
ccc|ccc|MFT Service ID|Administrators;Users|S||3|3

In other words, it is multiline pipe (|) delimited text with a header line. (Like default table list from many SQL DBMS's.) The format shown in your original description cannot be reliably processed.

If my speculation about your raw data is correct, you first change delimiter to comma, then use multikv to extract from the table, like this:

| rex mode=sed "s/\|/,/g"
| multikv forceheader=1
| table name	fname	desc	group	cat	exp	set	in

 Here is an emulation for you to play with and compare with real data:

| makeresults
| fields - _time
| eval _raw = "name|fname|desc|group|cat|exp|set|in
abc|abc||Administrators;Users|S||1|1
bbb|bbb|Internal||N||2|2
ccc|ccc|MFT Service ID|Administrators;Users|S||3|3"
``` data emulation above ```

Output from this emulation is

name	fname	desc	group	cat	exp	set	in
abc	abc		Administrators;Users	S		1	1
bbb	bbb	Internal		N		2	2
ccc	ccc	MFT Service ID	Administrators;Users	S		3	3

[PickleRick]

Table is just a method of visualizing data. You need to parse your data into fields.

So the question is what the real data looks like (please copy-paste the raw event into a code block or a preformatted paragraph) and what it means. For now you have a lot of pipe-delimited "fields" but no way of knowing which of them are the "header", which are "data" and how many of "data" rows are there.