topic Re: Multivalue Field Formatting Issue in Lookup Export in Splunk Search

Multivalue Field Formatting Issue in Lookup Export

Varun18 — Fri, 14 Mar 2025 02:22:09 GMT

Hi Team,

I have a multivalue field in one of the user fields, along with other fields. However, when exporting the data to an external lookup, the multivalue field is converted into a single value, comma-separated value.

For example, in my search, the userid field appears as follows:

userid

890000
pklstu
790000
c_pklstu

However, after exporting to the external lookup, it transforms into:

userid

890000,pklstu,790000,c_pklstu

I need the multivalue field to remain unchanged in the external lookup so that I can accurately compare user IDs with other lookups. I have tried using mvexpand before exporting, but it introduced other challenges.

Is there a way to ensure the multivalue field remains intact while exporting to the external lookup?"

Re: Multivalue Field Formatting Issue in Lookup Export

bowesmana — Fri, 14 Mar 2025 04:23:20 GMT

What do you mean an "external lookup" and how are you exporting it?

Do you mean outputlookup or something else?

Re: Multivalue Field Formatting Issue in Lookup Export

Varun18 — Fri, 14 Mar 2025 05:01:49 GMT

Hi @bowesmana ,

my bad, I meant splunk lookups. I'm using outputlookup command to export search output data to Splunk lookup.

Regards

Re: Multivalue Field Formatting Issue in Lookup Export

yuanliu — Fri, 14 Mar 2025 05:53:37 GMT

I need the multivalue field to remain unchanged in the external lookup so that I can accurately compare user IDs with other lookups. I have tried using mvexpand before exporting, but it introduced

By making the output a comma-delimited list is exactly keeping the multivalue unchanged. If userid from other data sources are to match 890000, for example, the only way to do this is to make 890000 on its own row.

If you want concrete help from volunteers, you need to carefully describe your use case. How is this to "compare user IDs with other lookups?" What does the data look like? What are symptoms of "problems" caused by mvexpand? As always, illustrate your point with exact data (anonymize as necessary).

Re: Multivalue Field Formatting Issue in Lookup Export

Varun18 — Fri, 14 Mar 2025 06:07:38 GMT

Hi @yuanliu ,

Thanks for your response.

If the user ID field contains multiple values separated by a delimiter, can it still be used as a lookup field when comparing it with other data that also contains user IDs?

For example, if the field contains four user IDs and one of them exists in another lookup table, the lookup fails because the values are comma-separated.

I would like to understand how to perform a lookup on multiple values separated by a delimiter.

Re: Multivalue Field Formatting Issue in Lookup Export

bowesmana — Fri, 14 Mar 2025 06:09:17 GMT

Use

| outputlookup mycsv.csv output_format=splunk_mv_csv

That keeps the lookup file with proper MV fields.

Re: Multivalue Field Formatting Issue in Lookup Export

yuanliu — Fri, 14 Mar 2025 06:27:01 GMT

I would like to understand how to perform a lookup on multiple values separated by a delimiter.

As I explained in my initial comment, there is no such match. (I mean, you CAN perform complicated maneuvers with such a table to accomplish matching. And I have. But don't call that a lookup.) Please explain exactly how you are going to use this lookup (using data illustration), AND what exact "problems" does mvexpand cause (again, using data illustration).