topic Re: How do you create several multivalued fields? in Splunk Search

How do you create several multivalued fields?

MaryvonneMB — Tue, 29 Sep 2020 22:52:05 GMT

Hi all,

I have several events like this:

Field_A // Field_B // Field_C
A // 1 // z
A // 2 // z
B // 3 // y
B // 4 // x

I would like to create two multivalued fields from Field_B and Field_C relative to Field_A, like this:

Field_A // Field_B // Field_C
A // 1::2 // z
B // 3::4 // y::x

I try mvcombine, but it works only when I have Field_A and Field_B (or Field_A and Field_C). I didn't find how to use it with several fields.

Thank you for any help

niketn — Tue, 22 Jan 2019 14:43:06 GMT

@MaryvonneMB how about

  <yourMainSearch>
  | stats values(Field_B) as Field_B values(Field_C) as Field_C by Field_A

MaryvonneMB — Tue, 22 Jan 2019 15:36:04 GMT

Thank you very much. I didn't though about stats values. I use mvjoin after to add separator I want and it works well 🙂