Expands the values of an array field into separated rows. This command is generally used to convert an array (horizontal) into a column (vertical). It preserves the input row if the specified field does not exist, is not an array, or is null.


explode FIELD
Required Parameter
Name of the field containing the array.


Calculate IP statistics

json "[{line: ''},{line:''}]" 
| eval ip = split(line, " ") 
| explode ip 
| stats count by ip
  1. json: Generates the data source using "[{line: ''},{line:''}]".
  2. eval: Assigns the value in form of array that evaluated the `split(line, " ")` function to the new ip field.
  3. explode: Explodes the array in the ip field in unit of array component, expanding the two rows into four.
  4. stats: Calculates the count of the number of rows in ip field.