topic How can I combine multiple fields with a common name results in to single column? in Splunk Search

How can I combine multiple fields with a common name results in to single column?

satyaallaparthi — Wed, 01 Feb 2023 15:25:19 GMT

How can I combine multiple fields results in to single column with common name for example Test1, Test2, Test3 and so on up to Test 20 with a common word as "Test" in all the fields (either using foreach or any other solution)?

Test1	Test2	Test3	Test4	Test5	Test6	Test7	Test8

1	6	11	16	21	26	31	36
2	7	12	17	22	27	32	37
3	8	13	18	23	28	33	38
4	9	14	19	24	29	34	39
5	10	15	20	25	30	35	40

Result:

Test21

so on

Any help would be appreciated.

Re: How can I combine multiple fields with a common name results in to single column

bowesmana — Tue, 31 Jan 2023 23:00:10 GMT

You could do this

| foreach Test* [ eval Data=mvappend(Data, '<<FIELD>>') ] | stats values(Data) as Data | mvexpand Data | sort Data

which will create a new field Data with all the values of the Test* fields and then it depends on what you want to do.

stats will collect all values of fields present into a single row with all values, then mvexpand/sort will expand them all to separate rows.

If you have duplicate numbers anywhere, they will be removed, so it depends on your output requirements