Join multiple fields into few unique field

yuming1127 — Tue, 15 Jun 2021 03:26:34 GMT

Hi,
I'm looking something similar to this, but please note that the description* wildcard can go up to 20+ fields, same goes to weight_*
I do tried foreach [|eval ] + coalesce(), not sure why some of my field values missing after the foreach loop.
just asking if there is another method other than foreach[]

my search...

product	description1	description2	weight_a	weight_b	weight_c
product_a	string_a	string_b	number_a	number_b	number_c
product_b	string_c	string_d	number_d	number_e	number_f
product_c	string_e	string_f	number_g	number_h	number_i

desired output

product	description	weight
product_a	description1=string_a description2=string_b	weight_a=number_a weight_b=number_b weight_c=number_c
product_b	description1=string_c description2=string_d	weight_a=number_d weight_b=number_e weight_c=number_f
product_c	description1=string_e description2=string_f	weight_a=number_g weight_b=number_g weight_c=number_i

Thanks in advance.

Re: Join multiple fields into few unique field

kamlesh_vaghela — Tue, 15 Jun 2021 04:39:09 GMT

@yuming1127

Can you please try this?

With your provided sample data this will work.

YOUR_SEARCH | fields product description1 description2 weight_a weight_b weight_c | eval description=mvappend("description1=".description1,"description2=".description2) | eval weight=mvappend("weight_a=".weight_a,"weight_b=".weight_b,"weight_c=".weight_c) | table product description weight

My Sample Search :

| makeresults | eval _raw="product description1 description2 weight_a weight_b weight_c product_a string_a string_b number_a number_b number_c product_b string_c string_d number_d number_e number_f product_c string_e string_f number_g number_h number_i"| multikv forceheader=1 | fields product description1 description2 weight_a weight_b weight_c | eval description=mvappend("description1=".description1,"description2=".description2) | eval weight=mvappend("weight_a=".weight_a,"weight_b=".weight_b,"weight_c=".weight_c) | table product description weight

in case of multiple description and weight fields try this.

My Sample Search :

| makeresults | eval _raw="product description1 description2 weight_a weight_b weight_c product_a string_a string_b number_a number_b number_c product_b string_c string_d number_d number_e number_f product_c string_e string_f number_g number_h number_i"| multikv forceheader=1 | fields product description1 description2 weight_a weight_b weight_c | foreach description* [| eval description=mvappend(description,"<<FIELD>>="+'<<FIELD>>')] | foreach weight_* [| eval weight=mvappend(weight,"<<FIELD>>="+'<<FIELD>>')] | table product description weight

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

topic Join multiple fields into few unique field in Splunk Search

Join multiple fields into few unique field

Re: Join multiple fields into few unique field