I have 4 mv fields, some with different number of values, all with no visible delimiter.
My search:
| inputlookup foo
| search DocID=1234
| table DocID, mvfield1, mvfield2, mvfield3, mvfield4
Returns:
DocID mvfield1 mvfield2 mvfield3 mvfield4
1234 date1 name1 object1 time1
date2 name2 object2 time2
name3 object3
How do I eval the query so that I get results that show the data on separate rows:
1234 date1 name1 object1 time1
1234 date2 name2 object2 time2
1234 name3 object3
You can use mvexpand
to do this but, IMHO, you should keep it the way that it is or add this to the end:
| nomv mvfield1 | nomv mvfield2 | nomv mvfield3 | nomv mvfield4
@woodcock, I agree - mvexpand is messy with this query. I've never used nomv, so I'll give that a try - is there a way to add a delimiter between the values that are now in one field? It would be nice to have them separated by a pipe or a semicolon.
Sure, you can do this instead:
... | foreach mvfield* [ eval <<FIELD>> = mvjoin(<<FIELD>>, "|") ]
I know this should work but it doesn't. I just keep getting blank results for the fields. Beginning to wonder if there's something broken with our data.