Trouble extracting multivalue fields- How do I separate these fields into their own events?

mistydennis — Tue, 27 Sep 2022 14:17:56 GMT

Hi all - I am having trouble pulling out mv fields into separate events. My data looks like this:

I'd like to pull each event out into it's own line, but I'm having trouble with the carriage returns and getting the fields to pair correctly (i.e., error 1232 is with server 1).

Example search:

How do I separate these fields into their own events so the data looks like:

1232	server1	server1:1232
2345	server2	server2:2345
5783	server3	server3:5783

Re: Trouble extracting multivalue fields

kamlesh_vaghela — Tue, 27 Sep 2022 12:46:10 GMT

@mistydennis

Can you please try this?

YOUR_SEARCH | eval t = mvzip(mvzip(server,error),uniquekey) | mvexpand t | rex field=t "(?<server>.*),(?<error>.*),(?<uniquekey>.*)" | table server error uniquekey

YOUR_SEARCH | eval t = mvzip(mvzip(server,error),uniquekey) | mvexpand t | eval server=mvindex(split(t,","),0), error=mvindex(split(t,","),1), uniquekey=mvindex(split(t,","),2) |table server error uniquekey

My Sample Search :

| makeresults | eval error="1232 2345 5783 5689 2345 5678 5901", server="server1 server2 server3 server4 server6 server9 server7" | makemv delim=" " error | makemv delim=" " server | eval uniquekey=mvzip(server,error, ":") | rename comment as "upto this is sample data" | eval t = mvzip(mvzip(server,error),uniquekey) | mvexpand t | eval server=mvindex(split(t,","),0), error=mvindex(split(t,","),1), uniquekey=mvindex(split(t,","),2) |table server error uniquekey

I hope this will help you.

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

topic Re: Trouble extracting multivalue fields in Getting Data In

Trouble extracting multivalue fields- How do I separate these fields into their own events?

Re: Trouble extracting multivalue fields