Closed dsmath closed 5 years ago
Hi @dsmath. Good input, I'm happy to write up something for you, but in the meantime here's something you could work with.
Given the following event
2019-01-02T08:00:42.001Z;foo;bar;baz
You can parse it up with the following parser
splitString(field=@rawstring, by=";")
| parseTimestamp(field=_splitstring[0])
| drop(_splitstring[0])
| rename(field=_splitstring[1], as=first)
| rename(field=_splitstring[2], as=second)
| rename(field=_splitstring[3], as=third)
Which will give you three fields
first
second
third
Implemented in v1.2.8 ...
Closing because it has been implemented. Please reopen if you disagree.
Parser documentation has several examples of unstructured and JSON based data sources. An example parser for a CSV data source in the documentation would be helpful for those of us with lesser regex skills.