Hi to all, i need to create a table for a multivalue event. Event is like:
field1=value1, field2=value2, field3="valueA,valueB,valueC,"
i need to create a table like
value1, value2, valueA
value1, value2, valueB
value1, value2, valueC
So i need to exapand to multivalue e create a row in the table for each value of field3.
mvexpand seems what i need, but at the and the table is something like:
value1, value2, valueA
valueB
valueC
Can someone please help me?
Thanks and regards
try this:
...|makemv field3 delim=","|mvexpand field3
try this run anywhere search:
|makeresults|eval field1="value1", field2="value2", field3="valueA,valueB,valueC"|makemv field3 delim=","|mvexpand field3
try this:
...|makemv field3 delim=","|mvexpand field3
try this run anywhere search:
|makeresults|eval field1="value1", field2="value2", field3="valueA,valueB,valueC"|makemv field3 delim=","|mvexpand field3
Nice!! Thanks you! I tried mvexpand or makemv, but not together.
Thanks!