1. Logpoint Service Desk
  2. Community
  3. SIEM - Searching & Analytics

Split same field values into two fields.

Avatar
Follow
0

If i have an event_category= User, Logon. I want to be able to create new fields (e.g. X, Y) and present data like X=User and Y=Logon. What would be the query to showcase this in result.

Share This Post:

1 comment

Date Votes
0
Avatar
Mike Blomgren

Hi,

You can use the ‘norm on’ command to identify individual fields/values within a specific field:

https://docs.logpoint.com/docs/search-query-language/en/latest/Search%20Query%20Language/One-to-One%20Commands.html#norm

https://docs.logpoint.com/docs/data-integration-guide/en/latest/Configuration/List%20of%20Definers.html

Untested, but in your case it should look like something this:

norm on event_category <X:string>, <Y:string> | fields event_category, X, Y

Please sign in to leave a comment.