topic Re: Dynamic variable fields generation in Splunk Search

Dynamic variable fields generation

victorsalazar — Fri, 04 Sep 2020 20:28:05 GMT

Hello Splunk Community

I would like to know if I can create a new column field from a multivalue field

MV field =

1, 2, 3, 4

then I have another MV field

a, b,c,d

after that I want my search result to look like in the picture

Thanks in advance

Re: Dynamic variable fields generation

richgalloway — Fri, 04 Sep 2020 20:52:23 GMT

You already have two MV fields so it's not clear what field you want to create.

To produce the example output from the example inputs, try this query.

Re: Dynamic variable fields generation

ITWhisperer — Fri, 04 Sep 2020 20:56:57 GMT

mvzip the two mv fields together, mvexpand to split into multiple events, rex out the two values, eval a new field using one field value for the name and the other field for the value, then use stats to join the events back together

| streamstats count as event_no | eval combined=mvzip(field1, field2) | mvexpand combined | rex field=combined "(?<key>[^,]*),(?<value>.*)" | eval {key}=value | stats values(*) as * by event_no

Re: Dynamic variable fields generation

victorsalazar — Tue, 08 Sep 2020 14:56:06 GMT

Thanks a lot both answer solved my problem