How can I split an event into a varible number of events?

[hvdtol]

Hello,

I have a directory structure which i want split up in separate events.

For example

\MAIN\SUB1\SUB2\SUB3\file.xlsx

This should be created as
\MAIN
\MAIN\SUB1
\MAIN\SUB1\SUB2\
\MAIN\SUB1\SUB2\SUB3\

Of course the number of subdirectories can vary, from 1 to many.
I know i cannot use a for loop command, so i am searching for a way to handle my challenge.

How should hanlde this, and is this possible?

Any help is apprecated.

Regards,

Harry

[hvdtol]

Hi,

Thank you, but not exactly what i mean.

| makeresults
| eval t="MAIN\\SUB1\\SUB2\\SUB3"
| table t
| eval path=split(t,"\\")
|mvexpand path
| table path

The number of rows i want to write can vary, depending om the number of subdirectories.
How can i write the events as

event1 MAIN
event2 MAIN\SUB1\
event3 MAIN\SUB1\SUB2\
event4 MAIN\SUB1\SUB2\SUB3
event x when longer... 

Regards,

Harry

[ITWhisperer · Accepted solution]

| makeresults count=2
| streamstats count as row
| eval t="MAIN\\SUB1\\SUB2\\SUB3".mvindex(split(",\\SUB4",","),row%2)
| table t row
| eval path=split(t,"\\")
| eval sub=mvrange(1,mvcount(path)+1)
| mvexpand sub
| eval partial=mvjoin(mvindex(path,0,sub-1),"\\")

[hvdtol]

Hi,

This is impressive.
I know you can do a lot with SPL, but i am always suprised when a ( for me not possible ) challenge can be accomplished.

Thank you very much.

[ITWhisperer]

| eval path=split(path,"\\")
| mvexpand path