topic Re: How to split multivalue fields after lookup? in Splunk Search

How to split multivalue fields after lookup?

skiourus — Thu, 02 Nov 2017 15:22:08 GMT

Hello after a search like this:

index=myindex|lookup mycsv.csv host_ip

I have the following output:

I would like to make it looks like this

assuming that the criticity is unique per host_ip regardless the number of time it appears.

Any help is welcome thanks.

Re: How to split multivalue fields after lookup?

elliotproebstel — Thu, 02 Nov 2017 16:58:52 GMT

I think mvexpand should do what you need. Here's some documentation on it:
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Mvexpand

Try adding this to the end of your query:
| mvexpand branch

Re: How to split multivalue fields after lookup?

kamlesh_vaghela — Thu, 02 Nov 2017 17:26:01 GMT

Hi
Can you please try below search??

YOUR_SEARCH
| eval tempField=mvzip(mvzip(host_ip,branch),criticity)
| stats count by _time, tempField 
| eval host_ip=mvindex(split(tempField,","),0), 
    branch=mvindex(split(tempField,","),1),
    criticity=mvindex(split(tempField,","),2)

Thanks

Re: How to split multivalue fields after lookup?

somesoni2 — Thu, 02 Nov 2017 18:25:14 GMT

Try this

index=myindex|lookup mycsv.csv host_ip
| mvexpand branch | eval criticity=mvdedup(criticity)

Re: How to split multivalue fields after lookup?

skiourus — Wed, 08 Nov 2017 15:28:48 GMT

Thank you all for your solutions.

I finally solved it by this command

index=myindex 
| lookup mycsv.csv host_ip
| stats count by host_ip,branch,criticity
| fields -count

it is time consuming but it does the job!