mvindex - How to separate results?

[dkeck]

Hi,

I have this code:

|rex max_match=0 field=values "value\":\"(?<example>(.*?))\""
|eval example=mvindex(example,0,1)

result is this :

*field*        *example*
action     failure success 

Is it possible to separate "failure" and "success" into 2 rows, so actually add a line break?
or at least add a ";" or ","?

Thank you

[chimell]

Hi
try this search code

|rex max_match=0 field=values "value\":\"(?<example>(.*?))\""| eval example=split(example ," ") | mvexpand example 

[ngatchasandra]

Hi dkeck,

If you want to add " ," or ";" to use makemv command like follow:

  |rex max_match=0 field=values "value\":\"(?<example>(.*?))\"" |eval example=mvindex(example,0,1) | makemv delim="," example

If you want to add linebreak you can try to use mvjoin function:

|rex max_match=0 field=values "value\":\"(?<example>(.*?))\"" |eval example=mvindex(example,0,1) | eval example=mvjoin(example," ") | rex mode=sed field=example "s/,/\n/g"

mvjoin(example," ") because values of example are separated by space

[jeffland · Accepted solution]

There are probably many ways to do that. You could use mvexpand:

|rex max_match=0 field=values "value\":\"(?<example>(.*?))\"" | mvexpand example

It should give you one line per value in your multivalue field while duplicating all other values.

[dkeck]

Thank you, but thats not what I want.

I want to keep the mvfield add just and some kind of separation to it, to make it more readable.

[jeffland]

Ah, I thought you wanted "two rows" in your table, but I assume you meant "two rows" inside your one result row, one for each value of your multivalue field.
That should be the case by default, so I'm not quite sure why your table has the two rex matches side by side. You could try this:

| rex max_match=0 field=values "value\":\"(?<example>(.*?))\"" | eval example=replace(example, "\s", ";\s")

It should add a semicolon into your text.