Convert range to set

[tcollins93]

How do I convert the string "1-4" to the multi-value field of {1,2,3,4}?

Thank you so much for you help, looking forward to a response

[somesoni2]

Try like this

..your current search | eval multivaluedfield=mvrange(mvindex(split(yourstringfield,"-"),0),mvindex(split(yourstringfield,"-"),1)+1)

[DalJeanis]

To break that down into a less efficient but more readable nearly-self-explaining code...

...your current search 
| eval TheRange=split(yourstringfield,"-")
| eval LowEnd=mvindex(TheRange,0)
| eval HighEnd=tonumber(mvindex(TheRange,1))+1
| eval multivaluedfield=mvrange(LowEnd,HighEnd)

The +1 is because mvrange halts when it gets to the high end of the range, not producing a result for that last step. You could use +.00000000001 and it would work the same.

[woodcock]

You need a tonumber around the HighEnd's call to mvindex.

[DalJeanis]

rakken sakken sassafrak mumble mumble... so many languages ... grekkle fraggle morgin frelling foldergarben overloaded operators smekk.... because no, + isn't enough of a clue for splunk...

[woodcock]

Turnabout is fair play!