topic Re: Multivalue field to multiple fields in Getting Data In

Multivalue field to multiple fields

yurykiselev — Wed, 11 Apr 2018 13:34:51 GMT

Hi!
How to split multivalue field, e.g. JSON array elements (value😞

{
  "id": 4321,
  "value": [
   5, 6, 7, 8
  ]
}

id     | value
4321     5 6 7 8

to multiple fileds with some index remaining one event:

id     | value_0 | value_1 | value_2 | value_3
4321     5         6         7         8

Thank you!

Re: Multivalue field to multiple fields

damien_chillet — Wed, 11 Apr 2018 13:46:35 GMT

Depends on the consistency of the value field but if it's always 4 numbers you could use something like this:

| rex field=value "(?P<value_0>\d+)\s(?P<value_1>\d+)\s(?P<value_2>\d+)\s(?P<value_3>\d+)"

Re: Multivalue field to multiple fields

p_gurav — Wed, 11 Apr 2018 14:06:27 GMT

Can you try :

| makeresults | eval abc="5 6 7 8"|eval temp=split(abc," ") | eval mv1 = mvindex(temp, 0) | eval mv2 = mvindex(temp, 1) | eval mv3 = mvindex(temp, 2) | eval mv4 = mvindex(temp, 3)

Re: Multivalue field to multiple fields

niketn — Wed, 11 Apr 2018 14:13:03 GMT

@yurykiselev, would there be 4 values under value list or it can be any number of values?

Re: Multivalue field to multiple fields

yurykiselev — Thu, 12 Apr 2018 08:16:00 GMT

It's good idea:

eval mv1 = mvindex(temp, 0) | eval mv2 = mvindex(temp, 1) | eval mv3 = mvindex(temp, 2) | eval mv4 = mvindex(temp, 3)

, but size of value is variable and I need to create mv1..n dynamically

Re: Multivalue field to multiple fields

yurykiselev — Fri, 13 Apr 2018 11:04:47 GMT

It can be any

Re: Multivalue field to multiple fields

niketn — Fri, 13 Apr 2018 17:12:33 GMT

@yurykiselev, please try the following run anywhere search which mimics two JSON data one with 4 values and another with three. The commands from | makeresults till | fields - _raw _time generates the dummy data, instead of which you would need to use your current search.

|  makeresults
|  eval _raw=" {
   \"id\": 4321,
   \"value\": [
    5, 6, 7, 8
   ]
 }"
 | append 
    [|  makeresults
|  eval _raw=" {
   \"id\": 1234,
   \"value\": [
    1, 2, 3
   ]
 }"]
 |  spath
 |  fields - _raw _time
 |  rename "value{}" as value
 |  eval values_count=mvcount(value)+1
 |  eval counter=mvrange(1,values_count)
 |  eval value=mvzip(value,counter)
 |  fields - counter values_count
 |  mvexpand value
 |  eval value=split(value,",")
 |  eval counter="value_".mvindex(value,1),value=mvindex(value,0)
 |  chart values(value) by id counter
 |  fillnull value=0