I have a space delimited field that may contain quoted values that also include spaces. For example:
Value1 Value2 Value3 Value4 "Value with a space 5" Value6
I think I need to use makemv, however this just nets me a exactly what you would expect:
| makeresults
| eval temp="Value1 Value2 Value3 Value4 \"Value with a space 5\" Value6"
| makemv temp
| fields - _time
Value1
Value2
Value3
Value4
"Value
with
a
space
5"
Value6
This leads me to think that I need a regex to parse it correctly, however I am no regex master. Anybody have any ideas?
Thanks!
Hi
Try this
| makeresults
| eval temp="Value1 Value2 Value3 Value4 \"Value with a space 5\" Value6"
| rex field=temp max_match=0 "(?P<temp>\"[^\"]*\"|[\S]+)+"
| mvexpand temp
| eval temp = replace(temp,"\"","")
| mvcombine temp
| table temp
Hi
Try this
| makeresults
| eval temp="Value1 Value2 Value3 Value4 \"Value with a space 5\" Value6"
| rex field=temp max_match=0 "(?P<temp>\"[^\"]*\"|[\S]+)+"
| mvexpand temp
| eval temp = replace(temp,"\"","")
| mvcombine temp
| table temp
I've implemented this into my query and it is working perfectly! Thanks!
Can you explain what you're looking to get out of that ?
I knew I forgot something.
The field temp should be a mv field containing the follwing:
Value1
Value2
Value3
Value4
Value with a space 5
Value6