I have field in the event which has multi-line data (between double quotes) and I need to split them into individual lines and finally extract them into a table format for each of the header. Basically, the requirement is to report this data in table format to users.
output = "DbName|CurrentSizeGB|UsedSpaceGB|FreeSpaceGB|ExtractedDate
abc|60.738|39.844|20.894|Sep 5 2023 10:00AM
def|0.098|0.017|0.081|Sep 5 2023 10:00AM
pqr|15.859|0.534|15.325|Sep 5 2023 10:00AM
xyz|32.733|0.675|32.058|Sep 5 2023 10:00AM"
@yuanliu - Its not working for this requirement. I see its returning entire output field value multiple times (equal to number of lines in the field.)
Its not working for this requirement. I see its returning entire output field value multiple times (equal to number of lines in the field.)
Note "not working" is about the least informative phrase in the best of scenarios as it conveys virtually no information. Yes, the original output field is expected to be attached to each row. If you don't want to see that, filter it out.
| eval _raw = replace(output, "\|", ",")
| multikv
| fields - _* linecount output
The real question is: are fields DbName, CurrentSizeGB, etc., extracted? (Each row is its own event. If you want multivalued fields in instead, you can do some stats.) Here is an emulation that you can play with and compare with real data:
| makeresults
| eval output = "DbName|CurrentSizeGB|UsedSpaceGB|FreeSpaceGB|ExtractedDate
abc|60.738|39.844|20.894|Sep 5 2023 10:00AM
def|0.098|0.017|0.081|Sep 5 2023 10:00AM
pqr|15.859|0.534|15.325|Sep 5 2023 10:00AM
xyz|32.733|0.675|32.058|Sep 5 2023 10:00AM"
``` data emulation above ```
The above emulated input combined with the search gives
CurrentSizeGB | DbName | ExtractedDate | FreeSpaceGB | UsedSpaceGB |
60.738 | abc | Sep 5 2023 10:00AM | 20.894 | 39.844 |
0.098 | def | Sep 5 2023 10:00AM | 0.081 | 0.017 |
15.859 | pqr | Sep 5 2023 10:00AM | 15.325 | 0.534 |
32.733 | xyz | Sep 5 2023 10:00AM | 32.058 | 0.675 |
If these fields are not extracted as expected, you need to illustrate your original data more precisely so volunteers can help diagnose. (Anonymous as needed.) In addition, illustration of actual output will also be helpful instead of a useless phrase like "not working".