Archive

Return position of value within a multivalue field?

Engager

Is there a command to return the position of a value within a multivalue field? I have already parsed out the multivalue field into individual rows, but want to add an associated identifier for each that tells me the position.

For example --

Original multivalue field: (A,B,C,D,E,F,G,H,I,J,K,L,....)

Ultimately I would like the MV field displayed as:

[value][position]

A 1

B 2

C 3

D 4

E 5

....

Any ideas? Any help would be appreciated!

Tags (2)

Path Finder

You can use streamstats in combination with mvexpand to achieve that.

The section up to here is used to produce your kind of data (and to add an unique identifier):

* | head 2 | streamstats count AS ID | eval value=if(ID=1,"A,B,C,D,E,F","G,H,I,J") | makemv delim="," value | table ID value

Now to return the position you use the following code:

* | head 2 | streamstats count AS ID | eval value=if(ID=1,"A,B,C,D,E,F","G,H,I,J") | makemv delim="," value | table ID value | mvexpand value | streamstats count AS position by ID  | table value position
0 Karma

Engager

Good questions.

Yes - the number of values in the mv field does change depending on the row.

Parsing done by:
source=...|makemv delim="," mvfieldname | mvexpand mvfieldname

0 Karma

Super Champion

Does the number of fields in the mv field change?
How did you "parse" out the fields?

0 Karma