How do you MVZIP more than one field?

[brajaram]

My data is in JSON format, and contains arrays of JSON data that can be from 1 to N blocks. In this JSON, fields can have the same value across the blocks.

If I have 3 multivalue fields across those blocks, how do I combine them? With mvzip, I can combine two. This lets me parse out the specific value for another value.

FieldA                    FieldB                    FieldC
Quick                     Brown                     Fox
Jumped                    Brown                     Fox
Over                      Brown                     The

So if I wanted to find all values of FieldA that corresponded to Brown Fox, then I want to be able to zip up FIeldA+FieldB+FieldC, then look for the specific combination of Brown and Fox. For 2 fields, I have done this with mvzip. How do I do this with three fields?

[vnravikumar · Accepted solution]

Hi

Try this

| makeresults 
| eval FieldA="Quick,Jumped,Over", FieldB="Brown,Brown,Brown", FieldC="Fox,Fox,The" 
| makemv delim="," FieldA 
| makemv delim="," FieldB 
| makemv delim="," FieldC 
| stats list(FieldA) as FieldA,list(FieldB) as FieldB,list(FieldC) as FieldC 
| eval temp=mvzip(FieldA,mvzip(FieldB,FieldC))

[brajaram]

Thanks for the help. I didn't realize I could use mvzip inside of an mvzip. Once I did that, it worked fine to find the specific cases we needed. Thanks!