how to get  the length of split in the field

Follow

Zero Wang

• October 17, 2019 08:28

Raw Message: Title=AAA,BBB,CCC,DDD

 

SQL

| parse "Title=*" as values

| split delim=',' //how to get  the length of split   as keywordCounter

| timeslice 1m
|
sum(keywordCounter) as keywordCounter,
count(*) as logCounter,
group by _timeslice

 

1

• 

  Rick Jury

  • November 11, 2019 21:36

  Hi,

  I'm not 100% clear on what you are asking for. Here are some examples of how you can tell lengths of split strings and how many fields there might be over a timeslice.

   

  * | limit 1000
  | "AAA,BBB,CCC,DDD" as title
  // you could use csv or split if you want to get actual fields
  | csv title extract 1 as a, 2 as b, 3 as c,4 as d
  | timeslice by 1m
  | length(title) as str_len
  | length(a) as a_len
  | replace(title,/[^,]/,"") as delim_only
  | length(delim_only) + 1 as num_fields
  | avg(num_fields) as num_fields,count as logcounter,avg(str_len) as title_len, avg(a) as a_len by _timeslice

  0

  Comment actions Permalink

Please sign in to leave a comment.