I have a string of status codes per component, something, like this:
0113000000000000000
To determine what this means, I need to join a lookup table I have, let's call it components.csv based on the position of the value in the string, for example:
position,component
1,paper
2,printer
3,screen
4,scanner
So, now I want to unpack the status string to get an output like this:
paper,0
printer,1
screen,1
scanner,3
Since my actual string is pretty long - 54 characters, I don't want to do an eval
for every possible position if I can help it.
My thinking is that if I can split the incoming field, with its position into a MV field, then maybe I could get the lookup working, e.g. getting to the point where my field looks like this: pos,status;pos,status;...
then it would be easy enough to do an inputlookup on my components.csv file...
@iaintealecapitec, following is run anywhere search to split your data into rows using position
field created through mvrange()
function as Value
and then use position
field to lookup components
and return the component
field from the lookup file.
| makeresults
| eval data="0113000000000000000"
| eval Length=len(data)
| eval position=mvrange(1,Length,1)
| mvexpand position
| table position
| eval Value=substr(data,counter,1)
| lookup components position output component
PS: You will not need first two pipes of the query here which is just to mock the data. Replace with your base search and also in third pipe replace data
with your field name | eval Length=len(<YourDataFieldName>)
@iaintealecapitec, following is run anywhere search to split your data into rows using position
field created through mvrange()
function as Value
and then use position
field to lookup components
and return the component
field from the lookup file.
| makeresults
| eval data="0113000000000000000"
| eval Length=len(data)
| eval position=mvrange(1,Length,1)
| mvexpand position
| table position
| eval Value=substr(data,counter,1)
| lookup components position output component
PS: You will not need first two pipes of the query here which is just to mock the data. Replace with your base search and also in third pipe replace data
with your field name | eval Length=len(<YourDataFieldName>)