Is there a way to break a field extraction that is delimited into a new row in a table?
Example Data:
2014-01-21 16:32:48,702 [MainThread] INFO tData.Data.Refresh.BlotterRefreshHandler - Blotter Refresh completed for MsgNum = 104, Order table, IDs: 238771427,228715752,238237071,236915854
I'd like to have a table that read something similar to below. What is a good clean way to approach this (or dirty!)?
_time source OrderID
2014-01-21 16:32:48 foo.csv 238771427
2014-01-21 16:32:48 foo.csv 228715752
2014-01-21 16:32:48 foo.csv 238237071
2014-01-21 16:32:48 foo.csv 236915854
Hello,
You can extract the IDs from the event,assuming you are not breaking them into rows before indexing. After you do get the ids on a single field, you just need to split it by ","
...|eval OrderIDs=split(ID,",")|table _time,source,OrderIDs|mvexpand OrderID
Thanks
Hello,
You can extract the IDs from the event,assuming you are not breaking them into rows before indexing. After you do get the ids on a single field, you just need to split it by ","
...|eval OrderIDs=split(ID,",")|table _time,source,OrderIDs|mvexpand OrderID
Thanks
Perfect! thanks. mvexpand is exactly what I was looking for 🙂