Your data is ugly. But almost all email data is ugly. So my solution will be even uglier (and horribly inefficient). | makeresults | eval attachments = mvappend("attachments", "doc1.pdf", "abc123"...
See more...
Your data is ugly. But almost all email data is ugly. So my solution will be even uglier (and horribly inefficient). | makeresults | eval attachments = mvappend("attachments", "doc1.pdf", "abc123", "doc2.pdf", "def456", "doc3.bla", "ghx789") | eval file_name=mvmap(split(replace(mvjoin(mvindex(attachments,1,mvcount(attachments)),"|"),"([^|]+)\|([^|]+)\|","\\1|\\2||"),"||"),replace(attachments,"\|.*","")) | makeresults | eval attachments = mvappend("attachments", "doc1.pdf", "abc123", "doc2.pdf", "def456", "doc3.bla", "ghx789") | eval file_hash=mvmap(split(replace(mvjoin(mvindex(attachments,1,mvcount(attachments)),"|"),"([^|]+)\|([^|]+)\|","\\1|\\2||"),"||"),replace(attachments,".*\|","")) You might want to adjust the separators from | and ||.