topic Re: How to get same values from mutlivalue field in Knowledge Management

How to get same values from mutlivalue field?

dhirendra761 — Thu, 29 Sep 2022 14:45:25 GMT

Hi,

We have below problem data in lookup:

pan	assestId	item_deviceId	phoneNumber	imeID
11023	ass#ABC1#man6558962f asst#ABC1#man827631e ite#0#man76451627ahdgs ite#0#man76451627ahd75	ite#0#man76451627ahdgs	8763173699	123456789
11023	ass#ABC1#man6558962f asst#ABC1#man827631e ite#0#man76451627ahdgs ite#0#man76451627ahd75	ite#0#man76451627ahd75	8736628187	987654321

Now we require new field "Mobile_DeviceId" from "assestId" for identical row.

As per below splunk table:

pan	assestId	item_deviceId	phoneNumber	imeID	Mobile_DeviceId
11023	ass#ABC1#man6558962f asst#ABC1#man827631e ite#0#man76451627ahdgs ite#0#man76451627ahd75	ite#0#man76451627ahdgs	8763173699	123456789	ass#ABC1#man6558962f
11023	ass#ABC1#man6558962f asst#ABC1#man827631e ite#0#man76451627ahdgs ite#0#man76451627ahd75	ite#0#man76451627ahd75	8736628187	987654321	asst#ABC1#man827631e

Is it possible from SPL?? Please help me to create SPL.

My query is:

Re: How to get same values from mutlivalue field

ITWhisperer — Thu, 29 Sep 2022 11:15:17 GMT

How do you identify which assestId is required as the Mobile_DevideId - assuming that there are an even number of assestIds and the device id in the first part of the list corresponds to the item in the second part of the list e.g. 1st matches with 3rd and 2nd matches with 4th (as in your example), then you could try something like this

| inputlookp abc.csv | table pan assestId item_deviceId phoneNumber imeID | eval Mobile_DeviceId=split(assestId," ") | eval Mobile_DeviceId=mvindex(Mobile_DeviceId,mvfind(Mobile_DeviceId, item_deviceId)%(mvcount(Mobile_DeviceId)/2))

Re: How to get same values from mutlivalue field

dhirendra761 — Thu, 29 Sep 2022 11:45:24 GMT

Thank you so much @ITWhisperer

You are awesome.

Re: How to get same values from mutlivalue field

dhirendra761 — Fri, 30 Sep 2022 11:08:16 GMT

Hi @ITWhisperer ,

What change required in query if we want to swap the value of Mobile_DeviceId?? without applying SORT command

Re: How to get same values from mutlivalue field

ITWhisperer — Fri, 30 Sep 2022 12:03:16 GMT

What do you mean by swap? What result are you trying to achieve?

Re: How to get same values from mutlivalue field

dhirendra761 — Fri, 30 Sep 2022 13:14:09 GMT

Swap means switch the value in last column.

Re: How to get same values from mutlivalue field

dhirendra761 — Fri, 30 Sep 2022 13:18:01 GMT

As per below splunk table:

pan	assestId	item_deviceId	phoneNumber	imeID	Mobile_DeviceId
11023	ass#ABC1#man6558962f asst#ABC1#man827631e ite#0#man76451627ahdgs ite#0#man76451627ahd75	ite#0#man76451627ahdgs	8763173699	123456789	asst#ABC1#man827631e
11023	ass#ABC1#man6558962f asst#ABC1#man827631e ite#0#man76451627ahdgs ite#0#man76451627ahd75	ite#0#man76451627ahd75	8736628187	987654321	ass#ABC1#man6558962f

Re: How to get same values from mutlivalue field

ITWhisperer — Fri, 30 Sep 2022 14:21:49 GMT

| inputlookp abc.csv | table pan assestId item_deviceId phoneNumber imeID | eval Mobile_DeviceId=split(assestId," ") | eval Mobile_DeviceId=mvindex(Mobile_DeviceId,(mvcount(Mobile_DeviceId)/2)-(mvfind(Mobile_DeviceId, item_deviceId)%(mvcount(Mobile_DeviceId)/2)))

Re: How to get same values from mutlivalue field

dhirendra761 — Tue, 04 Oct 2022 10:01:16 GMT

Thank You @ITWhisperer for your prompt support.

🙂