Return position of value within a multivalue field?

[pattyshychen]

Is there a command to return the position of a value within a multivalue field? I have already parsed out the multivalue field into individual rows, but want to add an associated identifier for each that tells me the position.

For example --

Original multivalue field: (A,B,C,D,E,F,G,H,I,J,K,L,....)

Ultimately I would like the MV field displayed as:

[value][position]

A 1

B 2

C 3

D 4

E 5

....

Any ideas? Any help would be appreciated!

[gschr]

You can use streamstats in combination with mvexpand to achieve that.

The section up to here is used to produce your kind of data (and to add an unique identifier):

* | head 2 | streamstats count AS ID | eval value=if(ID=1,"A,B,C,D,E,F","G,H,I,J") | makemv delim="," value | table ID value

Now to return the position you use the following code:

* | head 2 | streamstats count AS ID | eval value=if(ID=1,"A,B,C,D,E,F","G,H,I,J") | makemv delim="," value | table ID value | mvexpand value | streamstats count AS position by ID  | table value position

[pattyshychen]

Good questions.

Yes - the number of values in the mv field does change depending on the row.

Parsing done by:
source=...|makemv delim="," mvfieldname | mvexpand mvfieldname

[lukejadamec]

Does the number of fields in the mv field change?
How did you "parse" out the fields?