Need help splitting a single fields values into multiple chunks based on the length.

[mjones414]

I have a situation where I have a multi-value field that can contain anywhere from 1 to 2000 or more values in a day.  each value is exactly 38 characters long.  Each 38 character string is a GUID for another application, and that application can only accept up to 1000 characters at a time.  What I'd like to do is chunk the strings together in complete blocks of 20 which would be 760 characters per block, and then call them by mvindex, but I haven't figured out how to do this in eval so that it will create it whether I have 1 string, 23 strings, or 900 strings to evaluate, since that is always going to be the unknown variable.  Any assistance on how to solve this would be very helpful.

[ITWhisperer · Accepted solution]

Assuming guid doesn't contain commas, and you don't hit some sort of limit on string size (from the mvjoin), you could try something like this

| eval guids=mvjoin(guid,",")
| rex field=guids max_match=0 "(?<group>([^,]+,){1,20}[^,]+)"

[mjones414]

Brilliance!  Sheer Brilliance! Thank you so much!