Sorry, I forgot to say thanks ), your query was very helpful. Mvappend with segment number and |where substr triks helped me. Then i just used |rex to split necessary fields and add search rows with tokens for dashboard.And its working as i want. My result query:
|<my search and field extraction>
|replace "2017-*" with * in Date
|eval Me=mvappend("1","1","1","1","1","1")
|eval Ne=mvappend("2","2","2","2","2","2")
|eval Start_Time=strftime(_time,"%T")
|eval Start_Date=strftime(_time, "%Y-%m-%d")
|eval num=mvcount(Flight)
|eval Origin=mvindex(Departure,0)
|eval Origin_2=mvindex(Departure,1)
|eval Destination=mvindex(Arrival,0)
|eval Destination_2=mvindex(Arrival,-1)
|eval route=mvappend(mvzip(Origin,Destination,"-"),
(mvzip(Origin_2,Destination_2,"-")))
| eval numsegs= mvcount(route)
| eval routesegs=mvrange(1,numsegs+1)
| eval Flight5=mvzip(mvzip(routesegs,mvzip(Date,route,"#"),":"),Flight,"##")
|eval numseats=mvcount(Seat)/num
|eval numseats_2=numseats-1
|eval SeatClass=mvzip(Seat,Class_of_service,"#")
|eval passeg1=mvindex(SeatClass,0,numseats_2)
|eval passeg2=mvindex(SeatClass,numseats,-1)
|eval passegs=mvappend(mvzip(Me,passeg1,": "),
if(num>1,mvzip(Ne,passeg2,": "),null))
|eval FirstLast=mvzip(LastName,FirstName,"#")
|eval passenger=mvzip(passegs,FirstLast,";")
|table Start_Date,Start_Time,Flight5,passenger
| mvexpand Flight5
| mvexpand passenger
| where substr(Flight5,1,2) = substr(passenger,1,2)
| rex field=passenger "(?<CheckedInSeat>\w+)#(?<Class_Of_Service>\w+);(?<LastName>\w+)"#"(?<FirstName>\w+)"
|rex field=Flight5 "(?<Segment>\w+):(?<datem>\w+)-(?<dated>\w+)#(?<Departure>\w+)-(?<Destination>\w+)##(?<Flight>\w+)"
|eval Flight_Date=datem."-".dated
|fields - Flight5,passenger,datem,dated
|table Last* First* Start* Fl* Seg* Flight_Date Dep* Des* Class_Of_Service CheckedInSeat
... View more