Hi, I have a blob of text in both the title and description file, I've tried looking for how to seperate them when I am seraching but I have not found anything. It looks like
Question? NoIf yes, Question? N/ADoes this even do something? N/AIs the event a false positive? YesTicket number: N/ASource Unique Identifier (UI): Alert trigger time: Date/time UTCEvent start time: Date/time
etc
I would like it to look like this
Question? No
If yes, Question? N/A
Does this even do something? N/A
Is the event a false positive? Yes
Ticket number: N/A
Source Unique Identifier (UI):
Alert trigger time: Date/time UTC
Event start time: Date/time
The search I'm using is this
| inputlookup append=t investigative_canvas_entries_lookup
| table _time creator owner title description canvas_id
| sort -_time
First, verify whether there is an unprintable character between "Question? No" and "If yes, Question?". If so, we will need to key on that to split the data.
If not, then the next question is, are the question stems always exactly the same wording, or a small set of alternatives? In that case, we can use a rex to extract them to individual fields using a regex such as one of the following....
...if you want the questions and answers each separate...
| rex field=myfield "(?<Q1>Question\?)\s*(?<A1>.*?)(?<Q2>If yes, Question\?)\s*(?<A2>.*?)(?<Q3>Does this even do something\?)\s*(?<A3>.*?)(?<Q4>Is the event a false positive\?)\s*(?<A4>.*?)(?<Q5>Ticket number:)\s*(?<A5>.*?)(?<Q6>Source Unique Identifier \(UI\):)\s*(?<A6>.*?)(?<Q7>Alert trigger time:)\s*(?<A7>.*?)(?<Q8>Event start time:)\s*(?<A8>.*)"
...if you want each question and answer as a unit ...
| rex field=myfield "(?<Q1>Question\?\s*.*?)(?<Q2>If yes, Question\?\s*.*?)(?<Q3>Does this even do something\?\s*.*?)(?<Q4>Is the event a false positive\?\s*.*?)(?<Q5>Ticket number:\s*.*?)(?<Q6>Source Unique Identifier \(UI\):\s*.*?)(?<Q7>Alert trigger time:\s*.*?)(?<Q8>Event start time:\s*.*)"
First, verify whether there is an unprintable character between "Question? No" and "If yes, Question?". If so, we will need to key on that to split the data.
If not, then the next question is, are the question stems always exactly the same wording, or a small set of alternatives? In that case, we can use a rex to extract them to individual fields using a regex such as one of the following....
...if you want the questions and answers each separate...
| rex field=myfield "(?<Q1>Question\?)\s*(?<A1>.*?)(?<Q2>If yes, Question\?)\s*(?<A2>.*?)(?<Q3>Does this even do something\?)\s*(?<A3>.*?)(?<Q4>Is the event a false positive\?)\s*(?<A4>.*?)(?<Q5>Ticket number:)\s*(?<A5>.*?)(?<Q6>Source Unique Identifier \(UI\):)\s*(?<A6>.*?)(?<Q7>Alert trigger time:)\s*(?<A7>.*?)(?<Q8>Event start time:)\s*(?<A8>.*)"
...if you want each question and answer as a unit ...
| rex field=myfield "(?<Q1>Question\?\s*.*?)(?<Q2>If yes, Question\?\s*.*?)(?<Q3>Does this even do something\?\s*.*?)(?<Q4>Is the event a false positive\?\s*.*?)(?<Q5>Ticket number:\s*.*?)(?<Q6>Source Unique Identifier \(UI\):\s*.*?)(?<Q7>Alert trigger time:\s*.*?)(?<Q8>Event start time:\s*.*)"