Splunk Search

How to Push a Value onto a MultiValue field

DerekKing
Path Finder

Hi,

I would like to be able to push a new value into a multi-valued field, from another field.

ie.
Field1="Derek"
mvfield2="Paul" "Dave" "Bill"

I'd like to be able to do something like mvfield2=mvfield2 + Field1

It looks like I maybe able to get around it by converting the multivalued field to a delimited string, adding the value of field1, then make a new multivalued field, but that seems a long way around what seems like something simple.

Does anyone have any better ideas ?

Thanks for the help
Derek

1 Solution

somesoni2
Revered Legend

You can use "mvappend" function with eval to do this in one step.

runanywhere sample

| gentimes start=-1 | eval field1="Dave" | eval field2=split("Rob,Bob,John",",") | table field* | eval field3=mvappend(field2,field1)

View solution in original post

somesoni2
Revered Legend

You can use "mvappend" function with eval to do this in one step.

runanywhere sample

| gentimes start=-1 | eval field1="Dave" | eval field2=split("Rob,Bob,John",",") | table field* | eval field3=mvappend(field2,field1)

DerekKing
Path Finder

Thanks - Not sure how I missed that!

0 Karma
Get Updates on the Splunk Community!

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...