Question

Split same field values into two fields.

  • 8 December 2022
  • 1 reply
  • 59 views

Userlevel 1

If i have an event_category= User, Logon. I want to be able to create new fields (e.g. X, Y) and present data like X=User and Y=Logon. What would be the query to showcase this in result.


1 reply

Userlevel 1

Hi,

 

You can use the ‘norm on’ command to identify individual fields/values within a specific field:

 

https://docs.logpoint.com/docs/search-query-language/en/latest/Search%20Query%20Language/One-to-One%20Commands.html#norm

https://docs.logpoint.com/docs/data-integration-guide/en/latest/Configuration/List%20of%20Definers.html

 

Untested, but in your case it should look like something this:

norm on event_category <X:string>, <Y:string> | fields event_category, X, Y

 

Reply