Hi all,
I have a field named as item_description which is an array of decimal value, which represents the description of each item.
I hope to transfer each value in item_description into tex...
See more...
Hi all,
I have a field named as item_description which is an array of decimal value, which represents the description of each item.
I hope to transfer each value in item_description into text string for each item.
Original data:
| makeresults
| eval item_name = "Name_1,Name_2,Name_3,Name_4,Name_5", item_description = "65_66_67,68_69_70,71_72_73,74_75_76,77_78_79"
| makemv delim="," item_name
| makemv delim="," item_description
| eval mv_zipped=mvzip(item_name,item_description)
| mvexpand mv_zipped
| rex field=mv_zipped "(?P<ITEM_NAME>.*),(?P<ITEM_DESP>.*)"
| makemv delim="_" ITEM_DESP
| table _time ITEM_NAME ITEM_DESP
Although the purpose can be fulfilled by the following code.
| mvexpand ITEM_DESP
| eval ITEM_DESP_char=printf("%c",ITEM_DESP)
| eventstats list(ITEM_DESP_char) as ITEM_DESP_char by ITEM_NAME
| eval ITEM_DESP_join=mvjoin(ITEM_DESP_char,"")
| dedup ITEM_NAME _time
| table _time ITEM_NAME ITEM_DESP_join
Output:
_time
ITEM_NAME
ITEM_DESP_join
XXX
Name_1
ABC
YYY
Name_2
DEF
ZZZ
Name_3
GHI
000
Name_4
JKL
111
Name_5
MNO
If the item_description becomes very long(ex. lengh=50) and lots of items (ex. 50 items), the mvexpand command can't work properly with the output message below. Error message: command.mvexpand: output will be truncated at 28200 results due to excessive memory usage. Memory threshold of 500MB as configured in limits.conf / [mvexpand] / max_mem_usage_mb has been reached.
Is there any other way to transfer decimal value into ASCII and make the output as a string without using mvexpand command?
Thank you very much.