topic Re: Lookup is changing MV field to non MV in Splunk Search

Why is Lookup changing MV field to non MV?

morgantay96 — Tue, 21 Jun 2022 21:00:03 GMT

Hello I am a bit confused here but I have a search that runs and creates a multivalue field called "tags{}.name". This is a multivalue field pulled from JSON data. However when I then use the output of that search in a different search the field is no longer Multivalue and breaks if I try to split it. I need to either make this field delimited or ensure it remains a multi value field. Any help?

Search 1, Field is multivalue

Search 2, Field is no longer multivalue after using lookup.

Re: Lookup is changing MV field to non MV

PickleRick — Mon, 20 Jun 2022 19:49:50 GMT

Wait a second. You're trying to do an outputlookup and want the subsequent lookup from a lookup created that way to return a mv-field? IMHO it won't work this way. How is Splunk supposed to store the mv-field in a flat csv file? I don't think lookups are even supposed to hold mv-fields at all.

Re: Lookup is changing MV field to non MV

morgantay96 — Mon, 20 Jun 2022 20:05:47 GMT

Ok, that makes sense. So is there a way to squash that MV field before output to have the values delimited in some way to later expand?

Re: Lookup is changing MV field to non MV

morgantay96 — Mon, 20 Jun 2022 20:19:32 GMT

Solution was to use

| eval [new_field] = mvjoin([old_field], ";")

Re: Lookup is changing MV field to non MV

PickleRick — Mon, 20 Jun 2022 20:32:41 GMT

Yep. Exactly like you did - mvjoin()<->split()