topic Transform Comma Delimited Field (Extraction) Into Row in All Apps and Add-ons

Transform Comma Delimited Field (Extraction) Into Row

andrewkenth — Thu, 06 Feb 2014 15:40:12 GMT

Is there a way to break a field extraction that is delimited into a new row in a table?

Example Data:

2014-01-21 16:32:48,702 [MainThread] INFO  tData.Data.Refresh.BlotterRefreshHandler -     Blotter Refresh completed for MsgNum = 104, Order table, IDs: 238771427,228715752,238237071,236915854

I'd like to have a table that read something similar to below. What is a good clean way to approach this (or dirty!)?

_time source OrderID
2014-01-21 16:32:48 foo.csv 238771427
2014-01-21 16:32:48 foo.csv 228715752
2014-01-21 16:32:48 foo.csv 238237071
2014-01-21 16:32:48 foo.csv 236915854

Re: Transform Comma Delimited Field (Extraction) Into Row

linu1988 — Thu, 06 Feb 2014 15:47:35 GMT

Hello,
You can extract the IDs from the event,assuming you are not breaking them into rows before indexing. After you do get the ids on a single field, you just need to split it by ","

...|eval OrderIDs=split(ID,",")|table _time,source,OrderIDs|mvexpand OrderID

Thanks

Re: Transform Comma Delimited Field (Extraction) Into Row

andrewkenth — Thu, 06 Feb 2014 15:57:23 GMT

Perfect! thanks. mvexpand is exactly what I was looking for 🙂