explode

Expands the values of an array field into separated rows. This command is generally used to convert an array (horizontal) into a column (vertical). It preserves the input row if the specified field does not exist, is not an array, or is null.

Syntax

explode FIELD
Required Parameters
FIELD
Name of the field containing the array.

Usage

Calculate IP statistics

json "[{line: '10.0.0.1 10.0.0.2'},{line:'10.0.0.2 10.0.0.3'}]" 
| eval ip = split(line, " ") 
| explode ip 
| stats count by ip
  1. json: Generates the data source using "[{line: '10.0.0.1 10.0.0.2'},{line:'10.0.0.2 10.0.0.3'}]".
  2. eval: Assigns the value in form of array that evaluated the split(line, " ") function to the new ip field.
  3. explode: Explodes the array in the ip field in unit of array component, expanding the two rows into four.
  4. stats: Calculates the count of the number of rows in ip field.