topic Re: Split apart MV column into other columns in Splunk Search

Split apart MV column into other columns

dcase999 — Tue, 22 Jun 2021 16:42:20 GMT

Hi,

I have a MV field that I need to split apart into other mv fields

Here is the result of the query

What I want it to look like is

I've been fighting with MV commands but nothing seems to work quite like I wanted it to sooooo I figured I'd raise my hand and ask the Splunk Wizards 🙂

Re: Split apart MV column into other columns

ITWhisperer — Tue, 22 Jun 2021 16:46:38 GMT

First of all, you can't have two columns (fields) with the same name. Secondly, how do you know which dependency is an(other) application and which is a server?

Re: Split apart MV column into other columns

dcase999 — Tue, 22 Jun 2021 16:56:09 GMT

ooops on the application name - you are right, that can be changed to anything else

On the "what is an application vs what is a server" question, anything that begins with C-S would be a server, anything else would be an application.

Re: Split apart MV column into other columns

ITWhisperer — Tue, 22 Jun 2021 17:04:34 GMT

| makeresults | eval Criticality=1, Application="APblah", Name="Fred Flintstone", Dependencies=split("APsomeotherblah,DNSsomething,C-Ssomeserver,C-Ssomeotherserver",",") | table Criticality Application Name Dependencies | eval Servers=mvfilter(match(Dependencies,"^C-S.*")) | eval Applications=mvfilter(NOT match(Dependencies,"^C-S.*"))

Re: Split apart MV column into other columns

dcase999 — Tue, 22 Jun 2021 17:13:38 GMT

ok, wow that is most impressive! Many thanks @ITWhisperer !!!!