topic Re: How to format multi-value table in Splunk Search

How to format multi-value table

paulholguin — Thu, 26 Sep 2019 17:01:13 GMT

I need help formatting a mulitvalue field, the desired output below, followed by data in the field.

For the data in each event, we need 5 field-values in each row, hope this makes sense...

Desired output:

_time Field-Name
2019-09-25 13:45:15.810 000101194,000005090,000000845,000962003
000962000,000962002,000962004,000024909
000962001,000038594
_time Field-Name
2019-09-25 13:47:15.810 000101194,000005090,000000845,000962003
000962000,000962002,000962004,000024909
000962001,000038594,000962004,000024909
Data In field

000101194;000005090;000000845;000962003;000962000;000962002;000962004;000024909;000962001;000038594
000101194;000005090;000000845;000962003;000962000;000962002;000962004;000024909;000962001;000038594;000962001;00003859

Re: How to format multi-value table

Anantha123 — Thu, 26 Sep 2019 17:18:17 GMT

Try this

query | eval fieldName = field1+","+field2+","+field3+","+field4+","+field5 | table _time fieldName

Re: How to format multi-value table

paulholguin — Fri, 27 Sep 2019 14:48:35 GMT

I created this, works well, thanks for you support.

| eval TradingPartnerKPGroupNum=TradingPartnerKPGroupNum + ";"
| makemv tokenizer="(([\d]*[;]){1,5})" TradingPartnerKPGroupNum
| eval TradingPartnerKPGroupNum=rtrim(TradingPartnerKPGroupNum, ";")

Re: How to format multi-value table

paulholguin — Fri, 27 Sep 2019 14:48:42 GMT

| eval TradingPartnerKPGroupNum=TradingPartnerKPGroupNum + ";"
| makemv tokenizer="(([\d]*[;]){1,5})" TradingPartnerKPGroupNum
| eval TradingPartnerKPGroupNum=rtrim(TradingPartnerKPGroupNum, ";")