Splunk Search

How to create multivalue field from single value fields?

ohlafl
Communicator

I have several fields containing machine performance data named as CPUload and RAMload etcetera. They are dynamically calculated by searches such as eval value=if(valueFromSource > 0, "Value is: " "N/A"). These fields are to be concatenated into one row in a table column called "Operations" and the column to the left contains the name of the machine.

This almost works, but whenever I try to write something that would print this row as:

CPU load: 5%, RAM load: 10%

... it always ends up looking like this:

CPU load: 5%,
RAM load: 10%,

What am I doing wrong? I have tried everything from concatenating strings to multivalue operations, but whatever angle I try, it always turns out the same. I suspect that what I want to do is to create a multivalue field from two single value fields, but I am honestly not sure... any takers on this?

somesoni2
SplunkTrust
SplunkTrust

Just add following to end of your search

...Your current search ....| nomv Operations

ohlafl
Communicator

This would of worked if there was only one machine per environment but since there can up to four of them this happened:

CPU load: 5%, RAM load: 10%, Some Value: 4%, CPU load: 5%, RAM load: 10%, Some Value: 4%, CPU load: 5%, RAM load: 10%, Some Value: 4%

Everything on one row instead of:

CPU load: 56%, RAM load: 10%, Some Value: 23%, 
CPU load: 3%, RAM load: 15%, Some Value: 42%, 
CPU load: 1%, RAM load: 1%, Some Value: 46%, 

One row with three results per machine. Is this expected or have I done something wrong? I tried running makemv delim="," Operations| eval Operations=mvappend(CPUStatus, MemStatus) etcetera but the result was the same.

0 Karma

woodcock
Esteemed Legend

You need to do something like this (building your magastring before the stats😞

... | eval operations="host=" . host . ", CPUload=" . CPUload . ", RAMload=" . RAMload . ", SomeValue=" . if(valueFromSource<0, valueFromSource, "N/A") | stats list(operations) as Operations by Environment
0 Karma

richgalloway
SplunkTrust
SplunkTrust

It would be helpful to see the queries you've tried that came close to what you want.

Have you tried something like this?

... | eval Operations=CPUload.", ".RAMload | table machineName Operations
---
If this reply helps you, Karma would be appreciated.
0 Karma

ohlafl
Communicator

The last part of the query:

stats list(host) as Server list(operations) as Operations by Environment 

The machines have to be listed by the respective server and then the Operations row by its respective machine.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...