The problem here is my actual events are as below
1.event_id=1 name1=x name2=y name3=z responsetime1=4 responsetime2=5 responsetime3=6
2.event_id=2 name1=a name2=b name3=c responsetime1=7 responsetime3=8 responsetime3=9
I need something like this
events
1.event_id=1 name=x responsetime=4
2.event_id=1 name=y responsetime=5
3.event_id=1 name=z responsetime=6
4.event_id=2 name=a responsetime=7
5.event_id=2 name=b responsetime=8
6.event_id=2 name=c responsetime=9
See if this works
base search
| rex field=x max_match=0 "event_id=(?<event_id>\d+)"
| rex field=x max_match=0 "name\d=(?<name>\w+)"
| rex field=x max_match=0 "responsetime\d=(?<responsetime>\d+)"
| eval z=mvzip(name, responsetime)
| mvexpand z
| rex field=z "(?<name>[^,]+),(?<responsetime>.*)"
| streamstats count as event_id
| table event_id name responsetime
The problem here is my actual events are as below
1.event_id=1 name1=x name2=y name3=z responsetime1=4 responsetime2=5 responsetime3=6
2.event_id=2 name1=a name2=b name3=c responsetime1=7 responsetime3=8 responsetime3=9
I need something like this
events
1.event_id=1 name=x responsetime=4
2.event_id=1 name=y responsetime=5
3.event_id=1 name=z responsetime=6
4.event_id=2 name=a responsetime=7
5.event_id=2 name=x responsetime=8
6.event_id=2 name=x responsetime=9
Try updated ans