topic How to Push a Value onto a MultiValue field in Splunk Search

How to Push a Value onto a MultiValue field

DerekKing — Wed, 10 Dec 2014 17:48:15 GMT

Hi,

I would like to be able to push a new value into a multi-valued field, from another field.

ie.
Field1="Derek"
mvfield2="Paul" "Dave" "Bill"

I'd like to be able to do something like mvfield2=mvfield2 + Field1

It looks like I maybe able to get around it by converting the multivalued field to a delimited string, adding the value of field1, then make a new multivalued field, but that seems a long way around what seems like something simple.

Does anyone have any better ideas ?

Thanks for the help
Derek

Re: How to Push a Value onto a MultiValue field

somesoni2 — Wed, 10 Dec 2014 19:04:05 GMT

You can use "mvappend" function with eval to do this in one step.

runanywhere sample

| gentimes start=-1 | eval field1="Dave" | eval field2=split("Rob,Bob,John",",") | table field* | eval field3=mvappend(field2,field1)

Re: How to Push a Value onto a MultiValue field

DerekKing — Wed, 10 Dec 2014 19:09:55 GMT

Thanks - Not sure how I missed that!