https://community.splunk.com/t5/Splunk-Search/How-to-iterate-over-a-field-with-multiple-values-to-produce-a/m-p/288887#M161643 <P>Hi tpirozzi,<BR /> could you explain better your need?<BR /> Bye.<BR /> Giuseppe</P> Mon, 27 Mar 2017 12:05:43 GMT gcusello 2017-03-27T12:05:43Z https://community.splunk.com/t5/Splunk-Search/How-to-iterate-over-a-field-with-multiple-values-to-produce-a/m-p/288885#M161641 <P>Hi,</P> <P>I have a test field with multiple values</P> <P>A<BR /> B<BR /> C<BR /> D<BR /> etc...</P> <P>in my splunk query I want to iterate over that field and build a new field </P> <P>A@B<BR /> B@C<BR /> C@D<BR /> etc...</P> <P>Is there a way to accomplish this?<BR /> I tried some different things with eval but not able to build that field.</P> <P>Thanks in advance</P> Mon, 27 Mar 2017 10:49:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-iterate-over-a-field-with-multiple-values-to-produce-a/m-p/288885#M161641 tpirozzi 2017-03-27T10:49:22Z https://community.splunk.com/t5/Splunk-Search/How-to-iterate-over-a-field-with-multiple-values-to-produce-a/m-p/288886#M161642 <P>Use <CODE>streamstats</CODE>. This is exactly a use case for it. </P> <P>Try this assuming your special field is called "MyField" and the new field is "MyField_new"</P> <PRE><CODE>&lt;YOUR_BASE_SEARCH&gt; | streamstats last(MyField) as prev | eval MyField_new = MyFields ."@". prev | fields - prev </CODE></PRE> Mon, 27 Mar 2017 11:48:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-iterate-over-a-field-with-multiple-values-to-produce-a/m-p/288886#M161642 rjthibod 2017-03-27T11:48:06Z https://community.splunk.com/t5/Splunk-Search/How-to-iterate-over-a-field-with-multiple-values-to-produce-a/m-p/288887#M161643 <P>Hi tpirozzi,<BR /> could you explain better your need?<BR /> Bye.<BR /> Giuseppe</P> Mon, 27 Mar 2017 12:05:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-iterate-over-a-field-with-multiple-values-to-produce-a/m-p/288887#M161643 gcusello 2017-03-27T12:05:43Z https://community.splunk.com/t5/Splunk-Search/How-to-iterate-over-a-field-with-multiple-values-to-produce-a/m-p/288888#M161644 <P>Trying to build information for a Sankey Diagram.</P> Mon, 27 Mar 2017 13:12:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-iterate-over-a-field-with-multiple-values-to-produce-a/m-p/288888#M161644 tpirozzi 2017-03-27T13:12:55Z https://community.splunk.com/t5/Splunk-Search/How-to-iterate-over-a-field-with-multiple-values-to-produce-a/m-p/288889#M161645 <P>Thank you!</P> Mon, 27 Mar 2017 13:13:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-iterate-over-a-field-with-multiple-values-to-produce-a/m-p/288889#M161645 tpirozzi 2017-03-27T13:13:36Z https://community.splunk.com/t5/Splunk-Search/How-to-iterate-over-a-field-with-multiple-values-to-produce-a/m-p/288890#M161646 <P>This can also be done with the <CODE>autoregress</CODE> command as follows:</P> <PRE><CODE>&lt;YOUR_BASE_SEARCH&gt; | autoregress MyField | eval MyField_new = MyFields ."@". MyFields_p1 | fields - MyFields_p1 </CODE></PRE> Mon, 27 Mar 2017 17:53:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-iterate-over-a-field-with-multiple-values-to-produce-a/m-p/288890#M161646 woodcock 2017-03-27T17:53:01Z https://community.splunk.com/t5/Splunk-Search/How-to-iterate-over-a-field-with-multiple-values-to-produce-a/m-p/288891#M161647 <P>Thank you too</P> Tue, 28 Mar 2017 09:57:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-iterate-over-a-field-with-multiple-values-to-produce-a/m-p/288891#M161647 tpirozzi 2017-03-28T09:57:15Z