Hi,
I would like to be able to push a new value into a multi-valued field, from another field.
ie.
Field1="Derek"
mvfield2="Paul" "Dave" "Bill"
I'd like to be able to do something like mvfield2=mvfield2 + Field1
It looks like I maybe able to get around it by converting the multivalued field to a delimited string, adding the value of field1, then make a new multivalued field, but that seems a long way around what seems like something simple.
Does anyone have any better ideas ?
Thanks for the help
Derek
You can use "mvappend" function with eval to do this in one step.
runanywhere sample
| gentimes start=-1 | eval field1="Dave" | eval field2=split("Rob,Bob,John",",") | table field* | eval field3=mvappend(field2,field1)
You can use "mvappend" function with eval to do this in one step.
runanywhere sample
| gentimes start=-1 | eval field1="Dave" | eval field2=split("Rob,Bob,John",",") | table field* | eval field3=mvappend(field2,field1)
Thanks - Not sure how I missed that!