Hello,
I have _raw data like this:
time , name="AAAAAA",first_name="BBBBB"
When I look with table I saw this :
_time name first_name
12/20/2017 name="AAAAA" first_name="BBBBB"
How can I have the output result in showing the fields this way instead:
_time name first_name
12/20/2017 "AAAAA" "BBBBB"
Thank you for your help
To quickly fix this, so you can render your table correctly try:
<your search>|rex field=name "name=(?<newname>.*)"|rex field=first_name "first_name=(?<newfirst_name>.*)"|table _time newname newfirst_name
However as @richgalloway points out - you should probably fix this in props.conf
If you use it only once you can try it with this command
| rex field=_raw "name=\"(?<name>[^\"].+)\",first_name=\"(?<first_name>[^\"].+)\""
If you are using it more then one. Try to extract new fields with the field extractor. There you can also use the regex from above.
Standalone example using rex and overwriting existing field values
| makeresults
| eval name = "name=\"AAAA\""
| eval first_name = "first_name=\"BBBB\""
| rex field=name "name=(?<name>.*)"
| rex field=first_name "first_name=(?<first_name>.*)"
Standalone example showing further field extractions with rex (in case you wanted to remove the quotes)
| makeresults
| eval name = "name=\"AAAA\""
| eval first_name = "first_name=\"BBBB\""
| rex field=name "name=(?<name2>.*)"
| rex field=name "name=\"(?<name3>.*)\""
| rex field=first_name "first_name=(?<first_name2>.*)"
| rex field=first_name "first_name=\"(?<first_name3>.*)\""
It's probably something simple like adding kv_mode = auto
to your props.conf file. We could help more if you would share the props.conf settings for that sourcetype.