Transform Comma Delimited Field (Extraction) Into Row

[andrewkenth]

Is there a way to break a field extraction that is delimited into a new row in a table?

Example Data:

2014-01-21 16:32:48,702 [MainThread] INFO  tData.Data.Refresh.BlotterRefreshHandler -     Blotter Refresh completed for MsgNum = 104, Order table, IDs: 238771427,228715752,238237071,236915854

I'd like to have a table that read something similar to below. What is a good clean way to approach this (or dirty!)?

_time source OrderID
2014-01-21 16:32:48 foo.csv 238771427
2014-01-21 16:32:48 foo.csv 228715752
2014-01-21 16:32:48 foo.csv 238237071
2014-01-21 16:32:48 foo.csv 236915854

[linu1988 · Accepted solution]

Hello,
You can extract the IDs from the event,assuming you are not breaking them into rows before indexing. After you do get the ids on a single field, you just need to split it by ","

...|eval OrderIDs=split(ID,",")|table _time,source,OrderIDs|mvexpand OrderID

Thanks

[andrewkenth]

Perfect! thanks. mvexpand is exactly what I was looking for 🙂