Thank you for reply! What I showed you as example was not good. There are events like this. index=index_main
| table eventID,raw eventID raw 1 METHOD=POST|User-Agent=Mozilla|HTTP-CONTENT=img/jpeg 2 METHOD=GET|Referer=http://192.168.0.1 3 METHOD=POST|X-Forwarded-For=10.0.0.1|User-Agent=Firefox The wanted result is like this. I want to create new field which name is related http header. eventID2 does not have User-Agent Header, so you do not add raw_User_Agent field. ...
| table eventID,raw* eventID raw raw_METHOD raw_User_Agent raw_HTTP_CONTENT raw_Referer raw_X_Forwarded_For 1 METHOD=POST|User-Agent=Mozilla|HTTP-CONTENT=img/jpeg POST Mozilla img/jpeg 2 METHOD=GET|Referer=http://192.168.0.1 GET http://192.168.0.1 3 METHOD=POST|X-Forwarded-For=10.0.0.1|User-Agent=Firefox POST Firefox 10.0.0.1
... View more