Taking all pairs of elements in a multivalue field to use it in a macro

[eduardoduarte]

Hello.

I would like to be able to loop along all the elements of a multivalued field to compare all against each other. There is a macro in the following example that receives two arguments, I would like to check all the possible pairs from the mfield "MyField". Is this possible ?

In this example I am just checking the 0th element with the 1st element, but I want to check along all possible pairs in the multivalued field MyField if the outcome of the macro is higher than some value.

| makeresults
| eval MyField="AAA,ZAB,ZAA,RAA"
| makemv delim="," MyField
| eval f0=mvindex(MyField,0)
| eval f1=mvindex(MyField,1)
| `ut_levenshtein(f0,f1)`
| table MyField,f0,f1,ut_levenshtein

[jawaharas · Accepted solution]

You can use map command as shown below for your usecase

The map command is a looping operator that runs a search repeatedly for each input event or result.

| makeresults 
| eval MyField1="AAA,ZAB,ZAA,RAA" 
| makemv delim="," MyField1 
| mvexpand MyField1 
| map search="
    | makeresults 
    | eval MyField1=\"$MyField1$\", MyField2=\"AAA,ZAB,ZAA,RAA\" 
    | makemv delim=\",\" MyField2 
    | mvexpand MyField2
    |table MyField1, MyField2 " 
| `ut_levenshtein(MyField1,MyField2)`
| table *

[eduardoduarte]

oh, thank you very much. I did modification to your command in order to avoid the hardcoding of MyField2 in the map command.

However, I dunno if you can make a two line summary of what you are doing since I do not understnad how do you get all the combinations in different order.

| makeresults
| eval MyField1="AAA,ZAB,ZAA,RAA"
| eval tField=MyField1
| makemv delim="," MyField1
| mvexpand MyField1
| map search="
| makeresults
| eval MyField1=\"$MyField1$\"
| eval MyField2=\"$tField$\"
| makemv delim=\",\" MyField2
| mvexpand MyField2
|table MyField1, MyField2 "
| ut_levenshtein(MyField1,MyField2)
| table *

[jawaharas]

Glad it helped you.

• The map command is a looping operator that runs a search repeatedly for each input event
• The parent query (section before 'map' command) generates 'MyField1' field
• In the subquery (under 'map' command), 'MyField1' variable is passed in and for each event of parent query, all the events in subquery are executed.

Below SPL might explain you visually

| makeresults 
 | eval MyField1="A,B,C,D" 
 | makemv delim="," MyField1 
 | mvexpand MyField1 
 | map search="
     | makeresults 
     | eval MyField1=\"$MyField1$\", MyField2=\"One,Two,Three,Four\" 
     | makemv delim=\",\" MyField2 
     | mvexpand MyField2
     |table MyField1, MyField2 " 
 | `ut_levenshtein(MyField1,MyField2)`
 | table *

Can you upvote and accept the answer if it's helped you? Thanks.

[eduardoduarte]

Thank you very much! This was really helpful.