Hi
I want to change a multivalue field from:
Abcd=0.3333
GBTDF=0.25
JKLLIH=0.5
to:
Abcd 33%
GBTDF 25%
JKLLIH 50%
thx
ps: it's a not a simple field
What about this? You can ignore the first 4 lines that I used to replicate your use case.
| stats count
| fields - count
| eval event = "Abcd=0.3333, GBTDF=0.25, JKLLIH=0.5"
| eval event = split(event, ",")
| mvexpand event
| rex field=event "(?<key>[^=]+)=(?<value>[\d\.]+)"
| eval keyvalue = key . " " . round(value*100,0) . "%"
| fields - key, value, event
| stats list(keyvalue) as keyvalue
Output:
keyvalue
--------------
Abcd 33%
GBTDF 25%
JKLLIH 50%
Have you had a look at wether multikv can do what you want? If it doesn't, please provide more information.
What about this? You can ignore the first 4 lines that I used to replicate your use case.
| stats count
| fields - count
| eval event = "Abcd=0.3333, GBTDF=0.25, JKLLIH=0.5"
| eval event = split(event, ",")
| mvexpand event
| rex field=event "(?<key>[^=]+)=(?<value>[\d\.]+)"
| eval keyvalue = key . " " . round(value*100,0) . "%"
| fields - key, value, event
| stats list(keyvalue) as keyvalue
Output:
keyvalue
--------------
Abcd 33%
GBTDF 25%
JKLLIH 50%
thx javiergn it work ^^