topic Multi Field values into Single field value in Splunk Search

Multi Field values into Single field value

kamaleshwar — Tue, 19 Nov 2019 15:45:40 GMT

I need help in getting multiple field values into single field to compare it and get the match if any.

For example, I have Field 1, Field 2, and so on till Field 10 and similarly each field is having unique value. I need to check if any of the value is matching with other events and get that value.

Please help on this and let me know if more info needed.

Re: Multi Field values into Single field value

richgalloway — Tue, 19 Nov 2019 18:02:23 GMT

Can you show some example events and the expected output?

Re: Multi Field values into Single field value

Anantha123 — Tue, 19 Nov 2019 18:52:46 GMT

Hi,

To combine all fields in to 1 , you can try below query

| eval output=(mvappend(field1, field2, field3, field4, field5, field6, field7, field8, field9, field10)) | mvexpand output | dedup output | table output

Re: Multi Field values into Single field value

kamaleshwar — Wed, 20 Nov 2019 08:36:00 GMT

My log would have multiple user ids: userid1: "value"; userid2: "value" and so on. Here I need to get the userid value and compare it with other events to identify the same user id has been used in different activities/ multiple times.

The output would be like:
User ID Activity Count(Activity)

Let me know if this is helpful.

Re: Multi Field values into Single field value

kamaleshwar — Wed, 20 Nov 2019 08:38:58 GMT

The output should not be the concatenated value of all field values, It should unique value only. Because I need to compare each value with other events values to get the matched one using the same value in different activities and get them out from that.

Re: Multi Field values into Single field value

kamaleshwar — Fri, 22 Nov 2019 09:16:34 GMT

This worked, thanks a lot.