Why is mvexpand not working on lookup?

[GersonGarcia]

Hello,

I am trying to create dashboard input based on lookup table. I have simple lookup with monitor name and list of all components it may apply:

$ cat Itron_INS_monitors.csv
"Monitor_Name",Component
"AMM::DB::Unscheduled Jobs",DB
"APP:::Tibco::ERROR: Accept() failed: too many open files",TIBCO
"App::All::DB Connection Pool Exhausted","FWU
GMR
MPC
MT
NEM
ODS
THIRDPARTY
TMB
RMACA
CAAS
HCM
NEC
DMS
DLCA
*
FPS
SSNAGENT
SSNAGENTFORWARDER
TRAPROUTER
AMMWSROUTE
AMMJMSROUTE
ODSJMSROUTE
HCMWSROUTE
MPCWSROUTE
SENSORIQWSROUTE
ODSWSROUTE
AMMMULTISPEAK
REG
SAM
PM
SENSORIQ
TBR
ACTIVEMONITOR
ZCU"

For some reason, mvexpand does not work.

It is not memory, because my csv file has just ~100 lines.

Please help!!!

Thank you

[richgalloway]

mvexpand doesn't work because the field is not a multi-value field.  It's a single-value field with embedded newlines.  Try using the split function to break up the field then mvexpand should work.

... | fields Monitor_Name Component 
| eval Component=split(Component, "
")
| mvexpand Component

[GersonGarcia]

Yes, that works... Interesting why \n didn't...

[richgalloway]

It's because the split function does not accept regular expressions.  It expects plain text.

[GersonGarcia]

@richgalloway 

I tried both:

And:

Thank you!

[kamlesh_vaghela · Accepted solution]

@GersonGarcia 

You have to put a new line in the split function

|eval Component=split(Component,"
")

SPL.

| inputlookup Itron_INS_monitors.csv 
| table Monitor_Name Component
|eval Component=split(Component,"
")
| mvexpand Component

KV