Splunk Search

How to format multi-value table

paulholguin
New Member

I need help formatting a mulitvalue field, the desired output below, followed by data in the field.

For the data in each event, we need 5 field-values in each row, hope this makes sense...

Desired output:

_time Field-Name
2019-09-25 13:45:15.810 000101194,000005090,000000845,000962003
000962000,000962002,000962004,000024909
000962001,000038594
_time Field-Name
2019-09-25 13:47:15.810 000101194,000005090,000000845,000962003
000962000,000962002,000962004,000024909
000962001,000038594,000962004,000024909
Data In field

000101194;000005090;000000845;000962003;000962000;000962002;000962004;000024909;000962001;000038594
000101194;000005090;000000845;000962003;000962000;000962002;000962004;000024909;000962001;000038594;000962001;00003859

0 Karma

paulholguin
New Member

| eval TradingPartnerKPGroupNum=TradingPartnerKPGroupNum + ";"
| makemv tokenizer="(([\d]*[;]){1,5})" TradingPartnerKPGroupNum
| eval TradingPartnerKPGroupNum=rtrim(TradingPartnerKPGroupNum, ";")

0 Karma

Anantha123
Communicator

Try this

query
| eval fieldName = field1+","+field2+","+field3+","+field4+","+field5
| table _time fieldName

0 Karma

paulholguin
New Member

I created this, works well, thanks for you support.

| eval TradingPartnerKPGroupNum=TradingPartnerKPGroupNum + ";"
| makemv tokenizer="(([\d]*[;]){1,5})" TradingPartnerKPGroupNum
| eval TradingPartnerKPGroupNum=rtrim(TradingPartnerKPGroupNum, ";")

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...