Splunk Search

Create multivalued field in the search based on another field

hmahendrakumar
Path Finder

I wantto create a multivalued field bar based on the value of an existing field foo in each event. For example:

if we have these two events:

event1 foo=3
event2 foo=5

then i should create something like this

event1 foo=3 bar=1,2,3
event2 foo=5 bar=1,2,3,4,5
0 Karma

fox
Path Finder

what are potentially the min and max values that foo can be? This could also decide the approach...?

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

it might be helpful if you elaborated on what you intend to do with such a multivalued field. it's possible that whatever your ultimate goal is, it might be possible to achieve more directly without going through this generation of a field?

0 Karma

hmahendrakumar
Path Finder
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...