Hi,
I have an auto extracted field with comma separated values.
DesiredAccess = Read Data; List Directory; Read Attributes;
My goal is to turn it into a multi-value field with values Read Data;, List Directory; etc.
I tried several configs with props.conf and transforms.confm but doesn't works. Last one:
props.conf:
REPORT-DesiredAccess = mv-DesiredAccess
transforms.conf:
[mv-DesiredAccess]
SOURCE_KEY = DesiredAccess
DELIMS = " "
MV_ADD = true
Should I use TOKENIZER? How can I solve this, which path is the better in this case?
Thanks,
István
Does it have to be done at index time? Index-time transforms force all users to view data the same way, which is not always desirable.
It can be done at search time using ...| makemv delim=";" DesiredAccess |...
.
Does it have to be done at index time? Index-time transforms force all users to view data the same way, which is not always desirable.
It can be done at search time using ...| makemv delim=";" DesiredAccess |...
.
Hi,
There is nothing decided yet but at first sight, an automatic method would be preferred. Something in props.conf etc.
Istvan
Try TOKENIZER = (?<field>[^;]+);\s*
in fields.conf. I haven't used it before so I'm not sure it will work.
Hi, thanks, works. So this has to be done by fields.conf:)
I use the TOKENIZER = ([^;]+);\s*
format.
Regards
istván