topic Re: I'm trying to move fields from multi value fields using mvindex. Currently under "time" field I have only 3 values so i am easily moving them as new field. Is there anyway to automate this process without hard coding it? in Splunk Search

I'm trying to move fields from multi value fields using mvindex. Currently under "time" field I have only 3 values so i am easily moving them as new field. Is there anyway to automate this process without hard coding it?

praneeth2050 — Tue, 14 Jan 2020 16:38:57 GMT

time = 9:30
10:30
11:30
Currently I am doing this
| eval first.time=mvindex(time, 1), second.time=mvindex(time, 2), third.time=mvindex(time, 3)

This will give me first.time = 9:30, second.time= 10:30, third.time=11:30 fields moved from time field where it is a multivalued field. If i have undefined number of fields under this what should I do to automate it? instead of hardcoding it like | eval first.time=mvindex(time, 1), second.time=mvindex(time, 2), third.time=mvindex(time, 3) fourth.time=mvindex(time,4)............hundred.time=mvindex(time,100)

Re: I'm trying to move fields from multi value fields using mvindex. Currently under "time" field I have only 3 values so i am easily moving them as new field. Is there anyway to automate this process without hard coding it?

jpolvino — Tue, 14 Jan 2020 18:06:10 GMT

What is the problem are you trying to solve? Creating many fields like this is rarely a good idea.

Re: I'm trying to move fields from multi value fields using mvindex. Currently under "time" field I have only 3 values so i am easily moving them as new field. Is there anyway to automate this process without hard coding it?

praneeth2050 — Tue, 14 Jan 2020 18:20:58 GMT

So, I am trying to create a Splunk report with the changes in time and changes in other fields. The data I receive will have multiple time fields. For now i have only 3 time fields. In the future, I may even have 10 or 20-time fields... In the case of hardcoding using mvindex is there any alternative?

PS: I have extracted this multivalued field using REGEX

Re: I'm trying to move fields from multi value fields using mvindex. Currently under "time" field I have only 3 values so i am easily moving them as new field. Is there anyway to automate this process without hard coding it?

praneeth2050 — Wed, 15 Jan 2020 13:00:01 GMT

@niketnilay is it possible to help me out here?

Re: I'm trying to move fields from multi value fields using mvindex. Currently under "time" field I have only 3 values so i am easily moving them as new field. Is there anyway to automate this process without hard coding it?

to4kawa — Wed, 15 Jan 2020 13:44:24 GMT

| makeresults count=100
| streamstats current=f count
| eval time = (random() % 23).":30"
| stats list(time) as time
`comment("this is sample data, please check this")`
| eval counter=mvrange(0,mvcount(time))
| stats list(time) as time by counter
| eval time=mvindex(time,counter)
| sort 0 counter
| transpose 0 header_field=counter column_name=_col
| foreach *
    [rename <<FIELD>> as time_<<MATCHSTR>>]

Hi, @praneeth2050
It's a boring name, but it works.