This will implement the manipulation, as per your example. Generate sample data: | makeresults 1 | eval _raw="column_a=aaa,column_b=bbb,column_c=ccc,column_d=ddd,column_e=eee,column_f=fff,column_g=ggg" | extract | fields - _raw _time _kv Manipulate data: | eval column_e=column_e."_-_".column_d."_-_".column_c."_-_".column_b."_-_".column_a | fields - column_a, column_b, column_c, column_d | transpose column_name=name | rename "row 1" AS value | rex field=value "(?<value>.*)_-_(?<column_d>.*)_-_(?<column_c>.*)_-_(?<column_b>.*)_-_(?<column_a>.*)" | filldown | table column_a, column_b, column_c, column_d, name, value
... View more