Hello.
I would like to be able to loop along all the elements of a multivalued field to compare all against each other. There is a macro in the following example that receives two arguments, I would like to check all the possible pairs from the mfield "MyField". Is this possible ?
In this example I am just checking the 0th element with the 1st element, but I want to check along all possible pairs in the multivalued field MyField if the outcome of the macro is higher than some value.
| makeresults
| eval MyField="AAA,ZAB,ZAA,RAA"
| makemv delim="," MyField
| eval f0=mvindex(MyField,0)
| eval f1=mvindex(MyField,1)
| `ut_levenshtein(f0,f1)`
| table MyField,f0,f1,ut_levenshtein
You can use map command as shown below for your usecase
The map command is a looping operator that runs a search repeatedly for each input event or result.
| makeresults
| eval MyField1="AAA,ZAB,ZAA,RAA"
| makemv delim="," MyField1
| mvexpand MyField1
| map search="
| makeresults
| eval MyField1=\"$MyField1$\", MyField2=\"AAA,ZAB,ZAA,RAA\"
| makemv delim=\",\" MyField2
| mvexpand MyField2
|table MyField1, MyField2 "
| `ut_levenshtein(MyField1,MyField2)`
| table *
You can use map command as shown below for your usecase
The map command is a looping operator that runs a search repeatedly for each input event or result.
| makeresults
| eval MyField1="AAA,ZAB,ZAA,RAA"
| makemv delim="," MyField1
| mvexpand MyField1
| map search="
| makeresults
| eval MyField1=\"$MyField1$\", MyField2=\"AAA,ZAB,ZAA,RAA\"
| makemv delim=\",\" MyField2
| mvexpand MyField2
|table MyField1, MyField2 "
| `ut_levenshtein(MyField1,MyField2)`
| table *
oh, thank you very much. I did modification to your command in order to avoid the hardcoding of MyField2 in the map command.
However, I dunno if you can make a two line summary of what you are doing since I do not understnad how do you get all the combinations in different order.
| makeresults
| eval MyField1="AAA,ZAB,ZAA,RAA"
| eval tField=MyField1
| makemv delim="," MyField1
| mvexpand MyField1
| map search="
| makeresults
| eval MyField1=\"$MyField1$\"
| eval MyField2=\"$tField$\"
| makemv delim=\",\" MyField2
| mvexpand MyField2
|table MyField1, MyField2 "
| ut_levenshtein(MyField1,MyField2)
| table *
Glad it helped you.
Below SPL might explain you visually
| makeresults
| eval MyField1="A,B,C,D"
| makemv delim="," MyField1
| mvexpand MyField1
| map search="
| makeresults
| eval MyField1=\"$MyField1$\", MyField2=\"One,Two,Three,Four\"
| makemv delim=\",\" MyField2
| mvexpand MyField2
|table MyField1, MyField2 "
| `ut_levenshtein(MyField1,MyField2)`
| table *
Can you upvote and accept the answer if it's helped you? Thanks.
Thank you very much! This was really helpful.