Hi
I am trying to extract data from 2 multivalue fields and trying to form key value pair, for example, I have data something like below
_time, field1 , field2
10000, x:y:z 10:20:30
10001, a:b:c 40:50:60
I want to extract data something like this
10000, x 10
10000, y 20
10000, z 30
10001, a 40
10001, b 50
10001, c 60
I tried with makemv but not able to get the result in above format. any input is really appreciated. Thanks.
Hi @ramki1459 try this
| makeresults
| eval time=10000 | eval field1="x:y:z"
| eval field2="10:20:30"
| makemv delim=":" field1
| makemv delim=":" field2
| eval F2andF3=mvzip(field1,field2)
| mvexpand F2andF3
| rex field=F2andF3 "^(?<field1>[^,]+),(?<field2>.*)$"
| table time field1 field2
Hi @ramki1459 try this
| makeresults
| eval time=10000 | eval field1="x:y:z"
| eval field2="10:20:30"
| makemv delim=":" field1
| makemv delim=":" field2
| eval F2andF3=mvzip(field1,field2)
| mvexpand F2andF3
| rex field=F2andF3 "^(?<field1>[^,]+),(?<field2>.*)$"
| table time field1 field2