How do I convert the string "1-4" to the multi-value field of {1,2,3,4}?
Thank you so much for you help, looking forward to a response
Try like this
..your current search | eval multivaluedfield=mvrange(mvindex(split(yourstringfield,"-"),0),mvindex(split(yourstringfield,"-"),1)+1)
To break that down into a less efficient but more readable nearly-self-explaining code...
...your current search
| eval TheRange=split(yourstringfield,"-")
| eval LowEnd=mvindex(TheRange,0)
| eval HighEnd=tonumber(mvindex(TheRange,1))+1
| eval multivaluedfield=mvrange(LowEnd,HighEnd)
The +1 is because mvrange halts when it gets to the high end of the range, not producing a result for that last step. You could use +.00000000001 and it would work the same.
You need a tonumber
around the HighEnd's
call to mvindex
.
rakken sakken sassafrak mumble mumble... so many languages ... grekkle fraggle morgin frelling foldergarben overloaded operators smekk.... because no, + isn't enough of a clue for splunk...
Turnabout is fair play!