topic mvexpand multiple fields in Splunk Search

mvexpand multiple fields

michaelrosello — Mon, 25 Jun 2018 08:24:01 GMT

Is there a way to use mvexpand on multitple values?

This is the result of my current search and I want it to look like this below. Note that there will multiple multivalue fields so i cannot use the mvzip or can I?

SESSIONID    Timstamp    Value1   Value2  Value3 
1             06/21        1         2      3 
1             06/22        2         3      4

Re: mvexpand multiple fields

493669 — Mon, 25 Jun 2018 08:46:53 GMT

First use mvzip the multi-values into a new field:

 | eval total=mvzip(value1, value2)    // create multi-value field using value1 and value2
 | eval total=mvzip(total, value3)  // add the third field

Now, Expand the field and restore the values:

 | mvexpand total                    // separate multi-value into into separate events
 | makemv total delim=","            // convert the reading into a multi-value
 | eval value1=mvindex(total, 0)      // set value1 to the first value of total
 | eval value2=mvindex(total, 1)      // set value2 to the second value of total
 | eval value3=mvindex(total, -1)     // set value3 to the last value of total

Re: mvexpand multiple fields

FrankVl — Mon, 25 Jun 2018 09:11:07 GMT

To what extend would such an approach risk mixing up the connection between different 'rows' in the multi valued fields? Can you be sure that the first entry in multi valued field1 corresponds with the first entry in multi valued field2?

Might be safer to extract it as 1 field to begin with, then expand and only then split out to the individual fields?

Re: mvexpand multiple fields

madan27 — Tue, 09 Apr 2019 10:44:03 GMT

Please check this solution: https://answers.splunk.com/answers/724138/

Re: mvexpand multiple fields

ryhluc01 — Tue, 16 Apr 2019 21:11:45 GMT

Can you close out this question by choosing @493669 answer?

Re: mvexpand multiple fields

ryhluc01 — Tue, 16 Apr 2019 22:10:28 GMT

The -1 @ the end is recapturing the second result instead of the last. To fix this just remove the "-" in the last eval.