SPL: Use regex replacement string multiple times

[_Tom]

Hello *,

I am looking for an SPL that reads the first part of a string via regex and replaces all occurrences of a certain character with this first part. This is to be used for summary indexing. 

Example:

1;A__B
2;B__C__D__A__E
3;G

is to be transformed into (each line will become a value in a multivalue field):

1;A
1;B
2;B
2;C
2;D
2;A
2;E
3;G

Neither replace nor rex seem to be able to afford multiple replacements of this kind. I also tried foreach with some field extractions but failed. Before I write a custom search command for it, I hope for your ideas to solve the problem with some clever standard SPL.  

Thank you in advance for your thoughts!

[_Tom]

Hello @ITWhisperer,

thank you very much for the quick answer, which helped a lot. We need to do the transformation for multiple fields within a complex query. Therefore, the solution had to be adapted somewhat: 

| makeresults 
| eval fieldname1="1;A__B
2;B__C__D__A__E
3;G"
| eval other_fields_1="other_content"

| eval tmp_raw = _raw
| eval _raw=fieldname1 ``` temporarily overwriting _raw with the field value ```
| multikv noheader=t
| table _raw *other_fields* ``` to keep the fields which we still need ```
| eval first=mvindex(split(_raw,";"),0)
| eval second=split(mvindex(split(_raw,";"),1),"__")
| mvexpand second
| eval _raw=first.";".second
| rename _raw as fieldname1
| fields  - first,second
| mvcombine delim="\n" fieldname1 ``` to get a multivalue field ```
| eval _raw = tmp_raw
| table *

Is there a better solution than overwriting _raw with the field value? I also was surprised that creating a multikv.conf file seems not to be required, as it autodetects semicolon as the separator and ignores the underlines.

[ITWhisperer]

You could try rename _raw as tmp_raw and fieldname1 as _raw rather the two assignments but, this is as good a way as any to get multikv to work.

[ITWhisperer · Accepted solution]

| makeresults
| eval _raw="1;A__B
2;B__C__D__A__E
3;G"
| multikv noheader=t
| table _raw




| eval first=mvindex(split(_raw,";"),0)
| eval second=split(mvindex(split(_raw,";"),1),"_")
| mvexpand second
| where second!=""
| eval _raw=first.";".second