Is it possible to split comma separated values into a single column using field extraction?
for example:
input:
abcd, efgh, ijkl, mnop
output:
value 1 | value 2 | value 3 | value 4
------------------------------------------------
a | b | c | d
e | f | g | h
i | j | k | l
m | n | o | p
I know I can use something like <List>(?<val1>\w)(?<val2>\w)(?<val3>\w)(?<val4>\w)</list>
however is it possible to repeat the combination an unknown number of times within the brackets?
| makeresults
| eval _raw="abcd, efgh, ijkl, mnop"
| rex mode=sed "s/(.*)/value1, value2, value3, value4
\1/g"
| multikv forceheader=1
| foreach value*
[ eval <<FIELD>> = split(trim('<<FIELD>>'), "")]
| eval counter = mvrange(0,mvcount(value1))
| stats values(value*) as value* by counter
| foreach value*
[ eval <<FIELD>> = mvindex('<<FIELD>>' , counter) ]
| fields - counter
I don't know what INPUT is, so I make this.
If it is the result of any tallying, we can make it simply.
Like this:
|makeresults | eval _raw="abcd, efgh, ijkl, mnop, qrstu, vwxy"
| rex max_match=0 "(?<value1>[^\s,]+)(?<value2>[^\s,]+)(?<value3>[^\s,]+)(?<value4>[^\s,]+)"
Yes, but it's not pretty.
| makeresults
| eval input = "abcd, efgh, ijkl, mnop"
| eval input = split(input, ", ")
| mvexpand input
| eval input = split(input, "")
| streamstats count as v
| mvexpand input
| streamstats count as i by v
| eval value{i} = input
| stats values(value*) as value* by v
| fields - v
It's likely that your goal can be achieved with a different approach entirely.