topic Re: Split MV into new table rows in Getting Data In

Split MV into new table rows

ereed18 — Tue, 31 Jan 2017 21:14:14 GMT

I have rows where data looks like..

Value1^Value2^Value3
Value4^Value5
Value6
Value7^Value8

My query (below)...
search here | eval temp=split(FieldA,"^") | table temp

Makes the following..
1.Value1
Value2
Value3
2.Value4
Value5
3.....

I need each value to be on a separate row. Additionally, I need the count of each time the row is returned in the event. Currently when I add "| stats count by FieldA as hits" no data is returned.

Please help!

Re: Split MV into new table rows

somesoni2 — Tue, 31 Jan 2017 21:53:40 GMT

To see every field value in separate row

search here | eval temp=split(FieldA,"^") | table temp | mvexpand temp

To get the count

search here | eval temp=split(FieldA,"^") | table temp | stats count as hits by temp

Re: Split MV into new table rows

ereed18 — Wed, 01 Feb 2017 15:57:27 GMT

I had to move "mvexpand" in front of "table", but that works. Additionally, count had to go to the end when I was trying to count, table the field and count then expand the rows. I think my order might have caused my issues. Thanks!