replace multivalue field values

[mariobisio]

Hi guys,

I'm trying to replace values in an irregular multivalue field.

I don't want to use mvexpand because I need the field remains multivalue.

Here some examples of my multivalues fields

#1

115000240259839935-619677868589516300

1003000210260195023-294635473830872390

1003000210260241553-580541817408914764

531000140235102831-490142552617583496

115000240260262212-692365156372645389

#2

448000250026778748-44531981890881098

1286000030219284359-851572649149989069

I told irregular because the multivalue field could be compose by 1 or n values.

My goal is to keep only the numerical part before the "-"

for example:

the #1 should became

115000240259839935

1003000210260195023

1003000210260241553

531000140235102831

115000240260262212

the #2 should become:

448000250026778748

1286000030219284359

Thanks in advance for your help

Regards

Mario

[to4kawa]

| makeresults 
| eval field1="115000240259839935-619677868589516300
1003000210260195023-294635473830872390
1003000210260241553-580541817408914764
531000140235102831-490142552617583496
115000240260262212-692365156372645389"
| eval field2="448000250026778748-44531981890881098
1286000030219284359-851572649149989069"
| rename COMMENT as "from here, the logic"
| rex max_match=0 field=field1  "(?<result1>(?m)^\d+)"
| rex max_match=0 field=field2  "(?<result2>(?m)^\d+)"

How about rex?

[ITWhisperer · Accepted solution]

| eval yourfield=mvmap(yourfield,mvindex(split(yourfield,"-"),0))

[mariobisio]

Hi ITWhisperer,

this i s exactly what I was looking for.

Thank you very much

Great Job

Regards

Mario