topic Re: Merging two sets of multivalue data in an order without regex in Splunk Search https://community.splunk.com/t5/Splunk-Search/Merging-two-sets-of-multivalue-data-in-an-order-without-regex/m-p/337669#M100166 <P>Are you trying to convert rows into columns? See this gets you what you need.</P> <PRE><CODE>your current search giving fields Name Value | eval temp=1 | xyseries temp Name Value </CODE></PRE> Mon, 18 Sep 2017 04:29:40 GMT somesoni2 2017-09-18T04:29:40Z Merging two sets of multivalue data in an order without regex https://community.splunk.com/t5/Splunk-Search/Merging-two-sets-of-multivalue-data-in-an-order-without-regex/m-p/337667#M100164 <P>I have base search that was able to get me to this form in Splunk:</P> <P>Name Value<BR /> A 1<BR /> B 2<BR /> C 3</P> <P>I need to create a new key value pair that goes A = 1, B = 2, C = 3 and so forth. Is this possible without regex?</P> Sun, 17 Sep 2017 19:43:35 GMT https://community.splunk.com/t5/Splunk-Search/Merging-two-sets-of-multivalue-data-in-an-order-without-regex/m-p/337667#M100164 Stevelim 2017-09-17T19:43:35Z Re: Merging two sets of multivalue data in an order without regex https://community.splunk.com/t5/Splunk-Search/Merging-two-sets-of-multivalue-data-in-an-order-without-regex/m-p/337668#M100165 <P>You want the <CODE>mvzip</CODE> function... </P> <PRE><CODE> | eval NameValue=mvzip(Name, value,"=") </CODE></PRE> Sun, 17 Sep 2017 23:10:39 GMT https://community.splunk.com/t5/Splunk-Search/Merging-two-sets-of-multivalue-data-in-an-order-without-regex/m-p/337668#M100165 DalJeanis 2017-09-17T23:10:39Z Re: Merging two sets of multivalue data in an order without regex https://community.splunk.com/t5/Splunk-Search/Merging-two-sets-of-multivalue-data-in-an-order-without-regex/m-p/337669#M100166 <P>Are you trying to convert rows into columns? See this gets you what you need.</P> <PRE><CODE>your current search giving fields Name Value | eval temp=1 | xyseries temp Name Value </CODE></PRE> Mon, 18 Sep 2017 04:29:40 GMT https://community.splunk.com/t5/Splunk-Search/Merging-two-sets-of-multivalue-data-in-an-order-without-regex/m-p/337669#M100166 somesoni2 2017-09-18T04:29:40Z Re: Merging two sets of multivalue data in an order without regex https://community.splunk.com/t5/Splunk-Search/Merging-two-sets-of-multivalue-data-in-an-order-without-regex/m-p/337670#M100167 <P>I have tried this. The issue is that the data will appear as this:</P> <P>NameValue<BR /> A = 1<BR /> B = 2<BR /> C = 3...</P> <P>I can of course do a mvexpand but I will like A,B,C to be the key for me to search easily meaning I can do this:<BR /> | search A &lt; 2 and so forth</P> Mon, 18 Sep 2017 08:35:41 GMT https://community.splunk.com/t5/Splunk-Search/Merging-two-sets-of-multivalue-data-in-an-order-without-regex/m-p/337670#M100167 Stevelim 2017-09-18T08:35:41Z