Basically, each of the assigned items has a pre-defined "weight". Not all items with an assigned weight may appear in the field(array). For example, in the above example, if the field contains "`lifeinvpainkillers'", I would want that replaced with "1".
The eventual goal for the above would be to transform the above into:
Which I would then attempt to multiple out as follows:
And then finally sum the product into:
The issues I'm running into, in no particular order, are as follows:
1. Properly allowing for the fact that this field can be as simple as 2 expanded arrays; or as complex as 100 expanded arrays.
2. Properly replacing the text wherein the text I want to replace doesn't actually exist within the field. I would assume "fillnull" would be a potential solution; but then that would mess with the ordering of all future mv'd arrays.
3. Properly recalculating the amounts as shown above when the replacement is finished; and the numbers are where I'd like them to be.
Ultimately, I expect this to be a largely futile effort. Splunk isn't really the best system to attempt to do this in; but I figured I'd give it a shot. Any help would be greatly appreciated because I'm out of ideas.
As an example, this is an example of a much more complex array that would still need to be properly calculated by use of the same formula.