In the following search I divide data with multiple multi-value fields into one line at a time.
See this answer ↓
https://answers.splunk.com/answers/25653/mvexpand-multiple-multi-value-fields.html
| eval reading=mvzip(multi_value_field1, multi_value_field2) | eval reading=mvzip(reading, multi_value_field3) | eval reading=mvzip(reading, multi_value_field4) | mvexpand reading | makemv reading delim="," | eval field1=mvindex(reading, 0) | eval field2=mvindex(reading, 1) | eval field3=mvindex(reading, 2) | eval field4=mvindex(reading, 3) | ...
The result is OK with this search, but somehow the warning "Field 'reading' does not exist in the data." Is displayed.
Is there a way to avoid this warning?
my splunk ver : 6.5.3
Okay, assuming you have the same number of values for each multivalue field, there is a simpler method. And I'm annoyed that it's taken me six months to figure it out, all the while doing that complicated mvzip
two-step.
Do this instead...
| eval myFan=mvrange(0,mvcount(field1))
| mvexpand myFan
| eval field1=mvindex(field1,myFan)
| eval field2=mvindex(field2,myFan)
| eval field3=mvindex(field3,myFan)
| eval field4=mvindex(field4,myFan)
Okay, assuming you have the same number of values for each multivalue field, there is a simpler method. And I'm annoyed that it's taken me six months to figure it out, all the while doing that complicated mvzip
two-step.
Do this instead...
| eval myFan=mvrange(0,mvcount(field1))
| mvexpand myFan
| eval field1=mvindex(field1,myFan)
| eval field2=mvindex(field2,myFan)
| eval field3=mvindex(field3,myFan)
| eval field4=mvindex(field4,myFan)
@DalJeanis Are you assuming here that all the events have just 4 values in a multi-valued field? What if , each event has different no. of values?
@gsrivastava - The number 4 comes from the fact that there were four fields that were mvzipped together in @yutaka1005's example. The only assumption is that each of the four fields has the same number of values... although if not, then a backstop is that field1 is the field with the MOST values.
Facing the same issue @yutaka1005 . Did you find any solution?