Hi, I have a multi value field which contains some product codes separated by a code. Now the 2 events can have the same combination but they are jumbled for example -
A|B|C|E|D and A|B|D|E|C.
I want them to be counted as one. Please if someone can help how to do this.
This code will sort the values that are in myfield
into a consistent order.
| makemv myfield delim="|"
| eval myfield=mvsort(myfield)
| eval myfield=mvcombine(myfield,"|")
If for some reason you need to maintain the original order as well, then just put it into a different field name before you start.
| eval myfield2=myfield
| makemv myfield2 delim="|"
| eval myfield2=mvsort(myfield2)
| eval myfield2=mvcombine(myfield2,"|")
You can also do it in a single command by using split
instead of makemv
, and stringing each of the operations all together from the inside out.
| eval myfield2=mvcombine(mvsort(split(myfield,"|")),"|")
This code will sort the values that are in myfield
into a consistent order.
| makemv myfield delim="|"
| eval myfield=mvsort(myfield)
| eval myfield=mvcombine(myfield,"|")
If for some reason you need to maintain the original order as well, then just put it into a different field name before you start.
| eval myfield2=myfield
| makemv myfield2 delim="|"
| eval myfield2=mvsort(myfield2)
| eval myfield2=mvcombine(myfield2,"|")
You can also do it in a single command by using split
instead of makemv
, and stringing each of the operations all together from the inside out.
| eval myfield2=mvcombine(mvsort(split(myfield,"|")),"|")
Thanks Dal. This worked perfectly fine after a bit modifications in my query. I was actually using the mvsort command but with Pipe and I believe that's why it wasn't able to sort it. 🙂
Post a raw event please... Are you saying that a single field X is formed as X=A|B|C|D|E using pipes?
Yes. Example : A|B|C|E|D is from one of the event of field X and A|B|D|E|C could be another events of the same field X. Though they are same codes but they are jumbled. What I am looking for is when I count it kit should come as 2 (or whatever the number is) not 1.