I do have a CSV file that consist of below column EventName Start Time Username severity alertid The data on the alertid became a list when user assigned multiple alert.  Challenge: How to separate the list from alertid, create a new entry each and copy the same value of the remaining column. Below are the sample entry of CSV file. Event Name,Start Time,Username,severity,alertid "alert assigned","1617229938497","sampleuser","5","82574,82573,82572,82569,82568,82567" ------------------ Desired result. Event Name,Start Time,Username,severity,alertid "alert assigned","1617229938497","sampleuser","5","82574" "alert assigned","1617229938497","sampleuser","5","82573" "alert assigned","1617229938497","sampleuser","5","82572" "alert assigned","1617229938497","sampleuser","5","82569" "alert assigned","1617229938497","sampleuser","5","82568" "alert assigned","1617229938497","sampleuser","5","82567" ... View more

I would like to get a stats per week of a Customer that would be result like the Table 1. The data I'm playing with is 100+ Customer and randomly values. Table 1. Week CustomerA CustomerB CustomerC CustomerD CustomerE 27 60 0 0 37 22 28 110 0 0 35 21 29 65 0 0 56 20 30 33 0 0 72 13 31 4 0 0 2 3   Sample Raw log data: Date Customer Penalty 11-Dec CustomerA Code32 2-Nov CustomerB Code32 3-Oct CustomerA Code31 5-Dec CustomerA Code01 5-Nov CustomerA Code22 5-Nov CustomerC Code11 9-Nov CustomerB Code31   I used the Span command  to compile it as per Week and did the stats command below however this result not showing the way I need it.     |stats count by Customer by Week     My goal is to count the penalty of each customer per week and do some stack bar graph. Is there a way to count the specific value of the field(Customer) and use that KEY to be column name just like the Table 1 above? ... View more

String of variable alert_type: |detail.action=blocked|detail.devicename=hd03|detail.virus=fec_virus_macro_sic_1|detail.sha256=fd8a5b3ea9e59d3f863822cd2dddfbfded034f8ddad351c909732f18b1a82662|detail.md5=fecd3f3d9a9233c234bf0b455f73f65b Objective: Split the string by "|" and remove the "=" and followed characters.  Something like rstrip command however it wasn't working with multivalue. E.g. detail.action detail.devicename detail.virus detail.sha256 detail.md5 It seems I need to used the foreach command however I'm not sure how i will used it. ... View more