As far as I know using mvcommand only creates an MV field out of values from a single field. In a column for example. I need to combine several fields to a single MV_field but all these fields have different names.
For example, I have field1, field2, field3. And I need a single MV_field containing values for all of them. Also, it would nice if this could be dynamic in a way that I can combine 'field*' to 'MV_field' with all the values.
I am able to accomplish combining the different fields using evals mvappend function, but it doesn't take wildcards.
Example, "| eval MV_field=mvappend(field1,field2,field3)" works. But there isn't always the same amount of fields.
It would be really nice to be able to do "| eval MV_field=mvappend(field*)" to simply catch all that exist and throw them in a single MV_field.
Is this possible?
I believe mvappend is the right command. You just need a way to apply to a variable number of fields. Try the foreach command for that.
| eval MV_field = ""
| foreach field* [ eval MV_field = mvappend(MV_field, <<FIELD>>) ]
yup that'll do it. Thanks!
I believe mvappend is the right command. You just need a way to apply to a variable number of fields. Try the foreach command for that.
| eval MV_field = ""
| foreach field* [ eval MV_field = mvappend(MV_field, <<FIELD>>) ]