Splunk Search

How to form key, value pairs from 2 multivalue fields?

ramki1459
Explorer

Hi
I am trying to extract data from 2 multivalue fields and trying to form key value pair, for example, I have data something like below

_time,    field1 ,     field2
10000,  x:y:z         10:20:30
10001,  a:b:c         40:50:60

I want to extract data something like this

10000, x 10
10000, y 20
10000, z 30
10001, a 40
10001, b 50
10001, c 60

I tried with makemv but not able to get the result in above format. any input is really appreciated. Thanks.

0 Karma
1 Solution

harishalipaka
Motivator

Hi @ramki1459 try this

| makeresults 
| eval time=10000 | eval field1="x:y:z" 
 | eval field2="10:20:30" 
 | makemv delim=":" field1
 | makemv delim=":" field2
 | eval F2andF3=mvzip(field1,field2)
 | mvexpand F2andF3
 | rex field=F2andF3 "^(?<field1>[^,]+),(?<field2>.*)$"
 | table time field1 field2
Thanks
Harish

View solution in original post

0 Karma

harishalipaka
Motivator

Hi @ramki1459 try this

| makeresults 
| eval time=10000 | eval field1="x:y:z" 
 | eval field2="10:20:30" 
 | makemv delim=":" field1
 | makemv delim=":" field2
 | eval F2andF3=mvzip(field1,field2)
 | mvexpand F2andF3
 | rex field=F2andF3 "^(?<field1>[^,]+),(?<field2>.*)$"
 | table time field1 field2
Thanks
Harish
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...