Splunk Search

Split Multiple MV Fields with Different Number of Values

mistydennis
Communicator

I have 4 mv fields, some with different number of values, all with no visible delimiter.

My search:

    | inputlookup foo
    | search DocID=1234 
    | table DocID, mvfield1, mvfield2, mvfield3, mvfield4

Returns:

DocID     mvfield1     mvfield2     mvfield3     mvfield4
1234       date1        name1        object1      time1
           date2        name2        object2      time2
                        name3        object3

How do I eval the query so that I get results that show the data on separate rows:

1234  date1  name1  object1  time1
1234  date2  name2  object2  time2
1234         name3  object3
Tags (2)
0 Karma

woodcock
Esteemed Legend

You can use mvexpand to do this but, IMHO, you should keep it the way that it is or add this to the end:

| nomv mvfield1 | nomv mvfield2 | nomv mvfield3 | nomv mvfield4
0 Karma

mistydennis
Communicator

@woodcock, I agree - mvexpand is messy with this query. I've never used nomv, so I'll give that a try - is there a way to add a delimiter between the values that are now in one field? It would be nice to have them separated by a pipe or a semicolon.

0 Karma

woodcock
Esteemed Legend

Sure, you can do this instead:

... | foreach mvfield* [ eval <<FIELD>> = mvjoin(<<FIELD>>, "|") ]
0 Karma

mistydennis
Communicator

I know this should work but it doesn't. I just keep getting blank results for the fields. Beginning to wonder if there's something broken with our data.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...