So this is going to be a little...odd. I realize I'm asking a very circumstance-specific and idiosyncratic question; but I've tried working on this for a few hours no with absolutely no luck.
The field in Question is an array. That array can be anywhere from 0 arrays; to potentially infinite arrays. A sample of the array is below:
[[`life_inv_oilp`,10],[`life_inv_lockpick`,20],[`life_inv_redgull`,13]]
Basically, each of the assigned items has a pre-defined "weight". Not all items with an assigned weight may appear in the field(array). For example, in the above example, if the field contains "`life_inv_painkillers'", I would want that replaced with "1".
The eventual goal for the above would be to transform the above into:
[[2,10],[1,20],[1,13]]
Which I would then attempt to multiple out as follows:
[[20],[20],[13]]
And then finally sum the product into:
[53]
The issues I'm running into, in no particular order, are as follows:
1. Properly allowing for the fact that this field can be as simple as 2 expanded arrays; or as complex as 100 expanded arrays.
2. Properly replacing the text wherein the text I want to replace doesn't actually exist within the field. I would assume "fillnull" would be a potential solution; but then that would mess with the ordering of all future mv'd arrays.
3. Properly recalculating the amounts as shown above when the replacement is finished; and the numbers are where I'd like them to be.
Ultimately, I expect this to be a largely futile effort. Splunk isn't really the best system to attempt to do this in; but I figured I'd give it a shot. Any help would be greatly appreciated because I'm out of ideas.
As an example, this is an example of a much more complex array that would still need to be properly calculated by use of the same formula.
[[`life_inv_tbacon`,2],[`life_inv_lockpick`,20],[`life_inv_redgull`,13],[`life_inv_ziptie`,20],[`life_inv_debitcard`,1],[`life_inv_blindfold`,5],[`life_inv_defib`,1],[`life_inv_bloodbag`,5],[`life_inv_painkillers`,10]]
... View more