https://community.splunk.com/t5/Splunk-Enterprise/How-can-I-or-is-it-even-possible-to-make-arrays-out-of-a-and-b/m-p/642211#M16234 <P>Suppose I have data as follows:</P> <P>| makeresults<BR />| eval a = mvappend(a, "\"1\"")<BR />| eval a = mvappend(a, "\"2\"")<BR />| eval a = mvappend(a, "\"3\"")<BR />| eval a = mvappend(a, "\"4\"")<BR />| eval a = mvappend(a, "\"5\"")<BR />| eval b= mvjoin(a, ",")<BR />| table a, b</P> <P>Using SPL, how can I (or is it even possible to) make arrays out of a and b so that I have fields c=[<SPAN>"1","2","3","4","5"]&nbsp; and d=["1","2","3","4","5"] where c is an array of 5 quoted numerical values and d is an array of 1 single string of the comma separated string: "1","2","3","4","5"</SPAN></P> <P><SPAN>I know I can get arrays of values via extraction from JSON but is there a way to do this without JSON?</SPAN></P> Thu, 04 May 2023 13:50:54 GMT rberman 2023-05-04T13:50:54Z https://community.splunk.com/t5/Splunk-Enterprise/How-can-I-or-is-it-even-possible-to-make-arrays-out-of-a-and-b/m-p/642211#M16234 <P>Suppose I have data as follows:</P> <P>| makeresults<BR />| eval a = mvappend(a, "\"1\"")<BR />| eval a = mvappend(a, "\"2\"")<BR />| eval a = mvappend(a, "\"3\"")<BR />| eval a = mvappend(a, "\"4\"")<BR />| eval a = mvappend(a, "\"5\"")<BR />| eval b= mvjoin(a, ",")<BR />| table a, b</P> <P>Using SPL, how can I (or is it even possible to) make arrays out of a and b so that I have fields c=[<SPAN>"1","2","3","4","5"]&nbsp; and d=["1","2","3","4","5"] where c is an array of 5 quoted numerical values and d is an array of 1 single string of the comma separated string: "1","2","3","4","5"</SPAN></P> <P><SPAN>I know I can get arrays of values via extraction from JSON but is there a way to do this without JSON?</SPAN></P> Thu, 04 May 2023 13:50:54 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-can-I-or-is-it-even-possible-to-make-arrays-out-of-a-and-b/m-p/642211#M16234 rberman 2023-05-04T13:50:54Z