1

I am trying to split a column into multiple columns

The column has values like this:

 message
 ------------
 time=15:45:19 devname="FG3H0E3917903319" devid="FG3H0E3917903319" 
 logid="1059028705" type="utm" subtype="app-ctrl" eventtype="app-ctrl-all" 
level="warning" vd="root" eventtime=1564226119 appid=16009 
srcip=172.24.208.2 dstip=93.184.221.240 srcport=4832 dstport=80 
srcintf="LAN-RahaNet" srcintfrole="lan" dstintf="WAN-RahaNet" 
dstintfrole="lan" proto=6 service="HTTP" direction="outgoing" policyid=43 
 sessionid=493024483 applist="LanAppControl" appcat="Update" 
app="MS.Windows.Update" action="block" 
hostname="www.download.windowsupdate.com" incidentserialno=1522726002 
url="/msdownload/update/v3/static/trustedr/en/authrootseq.txt" msg="Update: 
MS.Windows.Update," apprisk="elevated"

Basically I need to split this column into:

time         devname                devid           ...
--------------------------------------------------------------
15:45:19    FG3H0E3917903319     FG3H0E3917903319     ...
4
  • Is this column a dictionary? Commented Jul 28, 2019 at 7:49
  • Does your dataframe contain more columns, or is it only one column. What you present looks very similar to a json dolument, except, that the = would have to be translated to : the keys would have to be separated by , and the documents contained in {}. The documents then again need to be separated by commas and placed between []. Commented Jul 28, 2019 at 8:03
  • If you just have this column in the dataframe, you have the source of the dataframe as a text file and are working on a unix-like system, I'd suggest you to try to preprocess it using sed to make the file a proper JSON file and then load it with pd.read_json. Commented Jul 28, 2019 at 8:06
  • my dataframe have other column/ Commented Jul 28, 2019 at 9:49

1 Answer 1

1

short answer:

  1. split the message on space, to get a list of key value pairs.
  2. split every key-value pair on = sign.
  3. add corresponding keys to their respective columns.
Sign up to request clarification or add additional context in comments.

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.