How can I convert the format of the values for a multivalue field?

[sfatnass]

Hi

I want to change a multivalue field from:

Abcd=0.3333
GBTDF=0.25
JKLLIH=0.5

to:

Abcd 33%
GBTDF 25%
JKLLIH 50%

thx

ps: it's a not a simple field

[gabriel_vasseur]

Have you had a look at wether multikv can do what you want? If it doesn't, please provide more information.

[javiergn · Accepted solution]

What about this? You can ignore the first 4 lines that I used to replicate your use case.

| stats count
| fields - count
| eval event = "Abcd=0.3333, GBTDF=0.25, JKLLIH=0.5"
| eval event = split(event, ",")
| mvexpand event
| rex field=event "(?<key>[^=]+)=(?<value>[\d\.]+)"
| eval keyvalue = key . " " . round(value*100,0) . "%"
| fields - key, value, event
| stats list(keyvalue) as keyvalue

Output:

keyvalue
--------------
Abcd 33%
GBTDF 25%
JKLLIH 50% 

[sfatnass]

thx javiergn it work ^^