I'm using the following code to split parts of the rawstring into their own fields.
| description := splitString(field=@rawstring, by="[,]", index=1)
| Queue := splitString(field=@rawstring, by="[,]", index=2)
| Roundtrip := splitString(field=@rawstring, by="[,]", index=3)
The issue I'm having is that the rawstring line isn't always the same. There are three different scenarios for it. Here are three examples of the scenarios:
{"home":0,"description":"a=1 b=(Block) t=52 A=2041 adbh=1111 (3539), Event: responseJson seq:[1]","queue_time":0,"roundtrip_time":28,"number":11111111111,"id":600}
{"home":0,"description":"a=1 b=(Block) t=52 A=2041 adbh=1111 (3539), Talkback: 1 seq:[1]","queue_time":0,"roundtrip_time":28,"number":11111111111,"id":600}
{"home":1,"description":"","queue_time":0,"roundtrip_time":46,"number":11111111111,"id":600}
Scenarios 1 and 2 have extra commas, causing "Event" and "Talkback" to be mistakenly placed in the "Queue" field. Is there a way, when these scenarios occur, to keep "Event" and "Talkback" in their intended position under "description"? I've been struggling to figure this out and would appreciate any guidance you can offer.