Splunk Search

foreach for mv fields?

smisplunk
Path Finder

I've got a search which uses a transaction command to combine a few log events together. As a result, I have a field which is multi-value. For chart display purposes, I'd like to truncate the values to a certain width. For a single-value column, I'd do something like eval if(length(field) > 30, substr(field, 1, 27) + "...", field). This doesn't work for a multi-value field. The "mvcount" of the multi-value field is not fixed, so iterating through each one by one isn't easily possible.

Any hints?

1 Solution

Ledion_Bitincka
Splunk Employee
Splunk Employee

while we currently do not supply a foreach command in eval you can try to truncate the field values before the transaction command (ie before the field becomes multivalued). For example:

... | eval field=if(length(field) > 30, substr(field, 1, 27) + "...", field) | transaction .... | chart .... 

View solution in original post

uuppuluri_splun
Splunk Employee
Splunk Employee

FWIW, the foreach command is now available as at http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Foreach

mschaaf_twc
Engager

The foreach command is for multiple fields and not for the items within a single multivalued field, which is what is desired here.

0 Karma

sideview
SplunkTrust
SplunkTrust

Hmm. I dont think eval can do this, but i could be wrong.

As a workaround, or arguably a simpler way to do the same thing, you can create a copy of the field before the transaction command, truncate those copies when they're out there, before they get packaged into transactions. Then keep the transaction logic the way it is now, but in the final display, use the truncated field, which will have been carried along for the ride.

Ledion_Bitincka
Splunk Employee
Splunk Employee

while we currently do not supply a foreach command in eval you can try to truncate the field values before the transaction command (ie before the field becomes multivalued). For example:

... | eval field=if(length(field) > 30, substr(field, 1, 27) + "...", field) | transaction .... | chart .... 

smisplunk
Path Finder

Didn't think of putting the truncation first. Nice!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...