Is there a command to return the position of a value within a multivalue field? I have already parsed out the multivalue field into individual rows, but want to add an associated identifier for each that tells me the position.
For example --
Original multivalue field: (A,B,C,D,E,F,G,H,I,J,K,L,....)
Ultimately I would like the MV field displayed as:
[value][position]
A 1
B 2
C 3
D 4
E 5
....
Any ideas? Any help would be appreciated!
You can use streamstats in combination with mvexpand to achieve that.
The section up to here is used to produce your kind of data (and to add an unique identifier):
* | head 2 | streamstats count AS ID | eval value=if(ID=1,"A,B,C,D,E,F","G,H,I,J") | makemv delim="," value | table ID value
Now to return the position you use the following code:
* | head 2 | streamstats count AS ID | eval value=if(ID=1,"A,B,C,D,E,F","G,H,I,J") | makemv delim="," value | table ID value | mvexpand value | streamstats count AS position by ID | table value position
Good questions.
Yes - the number of values in the mv field does change depending on the row.
Parsing done by:
source=...|makemv delim="," mvfieldname | mvexpand mvfieldname
Does the number of fields in the mv field change?
How did you "parse" out the fields?