Hi there, I have a bit of a tough one.
I have a log with multiple entries of the same field, basically a list of values. I am trying to merge these values into a single new field, with a line for every value that was in the RAW event.
An example:
2020-07-21T01:52:37+00:00 devicename=device1 | id=a522131 | date=2020-07-21T01:51:20 | name=peter | score=5 | action=read | randomfield1=nothingimportant | score=2 | action=read | score=2 | action=write | score=2 | action=write | randomfield2=nothingimportant
The intended resulting table where "actions" is a mv field, listing all actions (merging "score" and "action" as well), each on a line, but within the single field (actions):
name=peter
actions=
5:read
2:read
2:write
2:write
See if this helps.
| makeresults | eval _raw="2020-07-21T01:52:37+00:00 devicename=device1 | id=a522131 | date=2020-07-21T01:51:20 | name=peter | score=5 | action=read | randomfield1=nothingimportant | score=2 | action=read | score=2 | action=write | score=2 | action=write | randomfield2=nothingimportant"
```Above just creates test data```
| rex "\bname=(?<name>\w+)"
| rex max_match=0 "score=(?<score>\d+)"
| rex max_match=0 "action=(?<action>\w+)"
| eval actions=mvzip(score, action, ":")
| table name actions