How come I can't get mvdedup and mvexpand commands to work properly?

[rajim]

I have a query where I'm using mvexpand and mvdedup commands to extract some records and calculate related values. But unfortunately both the commands are not working properly. Below is the example what I'm getting. Can anybody please help me understand what's going wrong.

Query:

| inputlookup cee_dlp_base_report.csv
| table _time, User_Name, Detail_File_Size_MB
| mvexpand Detail_File_Size_MB 
| eval User_Name = mvdedup(User_Name)

[jkat54]

You need to add a ‘|makemv fieldName’

[jkat54]

Only you have two fields that need expand so you need to combine them into one field first.

| inputlookup ...
| eval a=mvzip(field1,field2)
| makemv a
| mvexpand a
| eval b=mvindex(a,0)
| eval c=mvindex(a,1)
| table b c

[FrankVl]

Looks like those fields are not actually multi valued. When you hover over them with your mousepointer, do you get highlights for the individual lines, or just for the whole event row together?

[rajim]

yes you are right. Whenever we are writing the multivalued fields into a csv file, the fields are converting into single value with all multivalued grouped. That's why mvdedup and mvexpand is not working. Thank you for pointing this.

[kamlesh_vaghela]

@rajim

Both User_Name & Detail_File_Size_MB multivalued fields? And what is the relation between them. If there is a relation then can you please try below search for work around?

| inputlookup cee_dlp_base_report.csv  | eval temp=mvzip(User_Name, Detail_File_Size_MB)
 | mvexpand temp
 | eval User_Name = mvindex(split(temp,","),0), Detail_File_Size_MB = mvindex(split(temp,","),1)
 | table _time, User_Name, Detail_File_Size_MB

For further analysis, can you please share sample data from lookup file?

[rajim]

No this is not helpful, as described below. Anyway thank you for your answer.