Splunk Search

multivalues in field

ken_t_huang
Explorer

I have a data like this:

NUM=001,Rules="Food Water"

NUM=002,Rules="Water Product"

NUM=003,Rules="Water"

NUM=004,Rules="Product"

NUM=005,Rules="Water Product"

and when I pick the field for "Rules", it shows:

rules (categorical)
Top 10 values of rules
Value               #     %
**Water Product     2     40%
Food Water          1     20%
Water               1     20%
Product             1     20%**

how can I show the correct category? like below:

rules (categorical)
Top 10 values of rules
Value       #     %
**Water     4     50%
Product     3     37.5%
Food        1     12.5%**

please kindly help this issue, thanks.

Tags (1)
1 Solution

sideview
SplunkTrust
SplunkTrust

This should work to turn the Rules field into a multivalue field.

<your search> | makemv delim=" " Rules

http://www.splunk.com/base/Documentation/latest/SearchReference/makemv

Or you dont want to use the search language to do it, you can read about how to configure the Rules field to automatically become extracted as a multivalued field. http://www.splunk.com/base/Documentation/4.2.1/Knowledge/ConfigureSplunktoparsemulti-valuefields

View solution in original post

0 Karma

sideview
SplunkTrust
SplunkTrust

This should work to turn the Rules field into a multivalue field.

<your search> | makemv delim=" " Rules

http://www.splunk.com/base/Documentation/latest/SearchReference/makemv

Or you dont want to use the search language to do it, you can read about how to configure the Rules field to automatically become extracted as a multivalued field. http://www.splunk.com/base/Documentation/4.2.1/Knowledge/ConfigureSplunktoparsemulti-valuefields

0 Karma

ken_t_huang
Explorer

hi nick, thanks you answer, I think set configure is better, but I don't know clear about this configure, could you give me an example? thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...