Transform a field into a multi-value field

[ikulcsar]

Hi,

I have an auto extracted field with comma separated values.

DesiredAccess = Read Data; List Directory; Read Attributes;

My goal is to turn it into a multi-value field with values Read Data;, List Directory; etc.

I tried several configs with props.conf and transforms.confm but doesn't works. Last one:

props.conf:
REPORT-DesiredAccess = mv-DesiredAccess

transforms.conf:
[mv-DesiredAccess]
SOURCE_KEY = DesiredAccess
DELIMS = " "
MV_ADD = true

Should I use TOKENIZER? How can I solve this, which path is the better in this case?

Thanks,
István

[richgalloway · Accepted solution]

Does it have to be done at index time? Index-time transforms force all users to view data the same way, which is not always desirable.

It can be done at search time using ...| makemv delim=";" DesiredAccess |....

[ikulcsar]

Hi,

There is nothing decided yet but at first sight, an automatic method would be preferred. Something in props.conf etc.

Istvan

[richgalloway]

Try TOKENIZER = (?<field>[^;]+);\s* in fields.conf. I haven't used it before so I'm not sure it will work.

[ikulcsar]

Hi, thanks, works. So this has to be done by fields.conf:)
I use the TOKENIZER = ([^;]+);\s* format.

Regards
istván