How to form key, value pairs from 2 multivalue fields?

[ramki1459]

Hi
I am trying to extract data from 2 multivalue fields and trying to form key value pair, for example, I have data something like below

_time,    field1 ,     field2
10000,  x:y:z         10:20:30
10001,  a:b:c         40:50:60

I want to extract data something like this

10000, x 10
10000, y 20
10000, z 30
10001, a 40
10001, b 50
10001, c 60

I tried with makemv but not able to get the result in above format. any input is really appreciated. Thanks.

[harishalipaka · Accepted solution]

Hi @ramki1459 try this

| makeresults 
| eval time=10000 | eval field1="x:y:z" 
 | eval field2="10:20:30" 
 | makemv delim=":" field1
 | makemv delim=":" field2
 | eval F2andF3=mvzip(field1,field2)
 | mvexpand F2andF3
 | rex field=F2andF3 "^(?<field1>[^,]+),(?<field2>.*)$"
 | table time field1 field2