Create New Fields From Another Field with Varying Values

[airalee]

Hello All,

Is there a way to create multiple fields from a single field separated by commas? But the number of values in the field will not always be the same and I'd like to do this through the search function as part of a correlation search.

Example:
sample_field=value1,value2,value3 => field1=value1, field2=value2, field3=value3
sample_field=value1,value2, value3,value4,value5 => field1=value1, field2=value2, field3=value3, field4=value4, field5=value5
sample_field=value1 => field1=value1

Thanks!

[kamlesh_vaghela · Accepted solution]

@airalee

Can you please try below search?

YOUR_SEARCH | eval data=split(sample_field,",") , n=1,r=1 
| accum n 
| mvexpand data 
| streamstats sum(r) as r by n 
| eval fields{r}=data 
| stats values(fields*) as fields* by _time, n,sample_field | fields - n

Sample search:

| makeresults 
| eval sample_field="value1,value2,value3||value1,value2,value3,value4,value5||value1",sample_field=split(sample_field,"||") 
| mvexpand sample_field 
| rename COMMENT as "This is sample of your search" 
| eval data=split(sample_field,",") , n=1,r=1 
| accum n 
| mvexpand data 
| streamstats sum(r) as r by n 
| eval fields{r}=data 
| stats values(fields*) as fields* by _time, n,sample_field | fields - n

Thanks

[airalee]

Thanks, this is what I was looking for!

[soumyasaha25]

if my understanding of your question is right, you want to extract new fields from an already existing field
if so you can try this:
lets say your original field is "original_field" and value is "i want to extract field1, field2, field3, field4 from my original_field"
you can use something like the below query

<your search>|rex field=original_field  ".*?extract\s(?<new_field1>.*?)\,\s(?<new_field2>.*?)\,\s(?<new_field3>.*?)\,\s(?"<new_field4>.*?)\,

[airalee]

Thanks! I looked into this, but I did not want to specify the number of fields as the sample_field could go up to an x amount of values. I appreciate the help though!