How to extract multivalue data to dynamic fields?

[jmartens]

I am trying to extract multi value fields and set dynamic fields with values based on the extracted data. I am able to extract the data but am unable to do the last part and generate dynamic fields, only the first is generated:

| makeresults 
| eval DICOMQuery="(0008,0052) Query/Retrieve Level [SERIES] | (0010,0020) Patient ID [1234567] | (0020,000D) Study Instance UID [1.2.34.567890.12.3456.789.123456.7.20230501130047.4915859] | (0020,000E) Series Instance UID [1.2.345.678.90.1.23456789012.34567890.20230508110959]"
| eval temp=split(DICOMQuery,"|") 
| rex field=temp "(?<DICOMGroup>([\dA-Fa-f]{4})),\d?(?<DICOMElement>([\dA-Fa-f]{4}))\)\s+(?<DICOMLabel>[^\[]+)\s\[(?<DICOMValue>[^\]]+)\]"
| eval {DICOMLabel}=DICOMValue
| fields - DICOMQuery DICOMLabel, DICOMValue temp

Which yields the following:

It seems I am nearly there, but I fail to get them as individual searchable fields which is what I am after. Any pointers?

[jmartens · Accepted solution]

After some more searching I stumbled on mvexpand and had to add it to expand the temp field like this:

| makeresults 
| eval DICOMQuery="(0008,0052) Query/Retrieve Level [SERIES] | (0010,0020) Patient ID [1234567] | (0020,000D) Study Instance UID [1.2.34.567890.12.3456.789.123456.7.20230501130047.4915859] | (0020,000E) Series Instance UID [1.2.345.678.90.1.23456789012.34567890.20230508110959]"
| eval temp=split(DICOMQuery,"|") 
| mvexpand temp
| rex field=temp "(?<DICOMGroup>([\dA-Fa-f]{4})),\d?(?<DICOMElement>([\dA-Fa-f]{4}))\)\s+(?<DICOMLabel>[^\[]+)\s\[(?<DICOMValue>[^\]]+)\]"
| eval {DICOMLabel}=DICOMValue
| fields - DICOMQuery DICOMLabel, DICOMValue temp