time = 9:30
10:30
11:30
Currently I am doing this
| eval first.time=mvindex(time, 1), second.time=mvindex(time, 2), third.time=mvindex(time, 3)
This will give me first.time = 9:30, second.time= 10:30, third.time=11:30 fields moved from time field where it is a multivalued field. If i have undefined number of fields under this what should I do to automate it? instead of hardcoding it like | eval first.time=mvindex(time, 1), second.time=mvindex(time, 2), third.time=mvindex(time, 3) fourth.time=mvindex(time,4)............hundred.time=mvindex(time,100)
... View more