explode
Expands the values of an array field into separated rows. This command is generally used to convert an array (horizontal) into a column (vertical). It preserves the input row if the specified field does not exist, is not an array, or is null.
Syntax
explode FIELD
Required Parameter
FIELD
- Name of the field containing the array.
Usage
Calculate IP statistics
json "[{line: '10.0.0.1 10.0.0.2'},{line:'10.0.0.2 10.0.0.3'}]"
| eval ip = split(line, " ")
| explode ip
| stats count by ip
- json: Generates the data source using "[{line: '10.0.0.1 10.0.0.2'},{line:'10.0.0.2 10.0.0.3'}]".
- eval: Assigns the value in form of array that evaluated the `split(line, " ")` function to the new ip field.
- explode: Explodes the array in the ip field in unit of array component, expanding the two rows into four.
- stats: Calculates the count of the number of rows in ip field.