Is the a function that does this:
... | mvmap data (fname, lname, age, height) | table lname, age
(where data
is a multivalue field)
No. You probably need something like:
... | fields lname age | eval z=mvzip(lname,age,":") | mvexpand z | eval z=split(z,":") | eval lname=mvindex(z,0) | eval age=mvindex(z,1) | fields - z
No. You probably need something like:
... | fields lname age | eval z=mvzip(lname,age,":") | mvexpand z | eval z=split(z,":") | eval lname=mvindex(z,0) | eval age=mvindex(z,1) | fields - z