topic How can i create new fields with data from two different multi value fields? in Splunk Search

How can i create new fields with data from two different multi value fields?

mauricio_sandov — Tue, 19 Sep 2023 17:14:50 GMT

I need to break out log data from two separate multi-value fields into single value fields. Here is what data looks like:

Each line of data from "participants{}.object_value" corresponds to the line in "participants{}.role" and I would like named victims and offender fields. I dont understand how to use the mv commands to expand the data from two different fields and then combine them into new fields.

Re: How can i create new fields with data from two different multi value fields?

richgalloway — Tue, 19 Sep 2023 17:28:59 GMT

Once multi-value fields are expanded, any relationship among them is lost. They need to be combined into a new field before expansion.

... | eval new_field = mvzip("participants{}.object_value", "participants{}.role") | mvexpand new_field | eval new_field = split(new_field, ",") | eval object_value = mvindex(new_field, 0), role = mvindex(new_field, 1)

The mvzip function combines two multi-value fields, separating them with a comma. The split function later on breaks the field on the comma. If you have more than two fields to combine, use nested mvzip functions.

| eval new_field = mvzip(field1, mvzip(field2, mvzip(field3, field4)))

Re: How can i create new fields with data from two different multi value fields?

mauricio_sandov — Mon, 25 Sep 2023 16:00:57 GMT

I will give this a shot to see what I get. thx

Re: How can i create new fields with data from two different multi value fields?

mauricio_sandov — Mon, 25 Sep 2023 16:59:14 GMT

Thank you this worked and did what I needed