MUltivalue fields

[bhavneeshvohra]

i have a field as abc=1\,2\,3\,4\,5\,

i need to reemove the backslashes and  have a multivalue field like abc=1,2,3,4,5

How to do this please help.

[manjunathmeti]

hi @bhavneeshvohra,

Use replace function with eval command OR rex command with sed.

| eval abc=replace(abc, "\\\\", "")

OR

| rex field=abc mode=sed "s/\\\//g"

Then if you want to make field abc a multivalued field using makemv:

| eval abc=replace(abc, "\\\\", "") | makemv delim="," abc

Field abc is further expanded using mvexpand,

| eval abc=replace(abc, "\\\\", "") | makemv delim="," abc | mvexpand abc

If this reply helps you, an upvote/like would be appreciated.