topic Re: How to append values from a field to all values of a multivalued field? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-append-values-from-a-field-to-all-values-of-a-multivalued/m-p/181579#M52319 <P>Thank you woodcock. Figured it out myself but thanks for the answer and sorry for the dumb question.</P> Tue, 30 Jun 2015 04:59:47 GMT kabiraj 2015-06-30T04:59:47Z How to append values from a field to all values of a multivalued field? https://community.splunk.com/t5/Splunk-Search/How-to-append-values-from-a-field-to-all-values-of-a-multivalued/m-p/181575#M52315 <P>Hi All, </P> <P>I have a multivalued field. I want to take values from one field and append the same to all the values of a multivalued field. The <STRONG>number</STRONG> of values present in multivalued field is NOT <STRONG>constant</STRONG>.</P> <P>Example: I have a multivalued field as error=0,8000,80001, and so on.<BR /> ( want to append values from a field such as 'TargetBandwidth' to all values like error=0:targetbandwidth, 8000:targetbandwidth, 8001:targetbandwidth, and so on.</P> <P>Any ideas on how to do that?</P> <P>Tried <CODE>eval error = error+":"+TargetBandwidth</CODE> but it didn't work. <BR /> Tried with <CODE>eval error = mvappend(error,TargetBandwidth)</CODE> but it appends values only to the last value of the mv field like error=0, 8000, 8001, and so on:targetbandwidth.</P> <P>Please help.</P> Mon, 29 Jun 2015 09:39:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-append-values-from-a-field-to-all-values-of-a-multivalued/m-p/181575#M52315 kabiraj 2015-06-29T09:39:23Z Re: How to append values from a field to all values of a multivalued field? https://community.splunk.com/t5/Splunk-Search/How-to-append-values-from-a-field-to-all-values-of-a-multivalued/m-p/181576#M52316 <P>Try this:</P> <PRE><CODE>... | mvexpand error | eval error = error . ":" . TargetBandwidth | mvcombine error </CODE></PRE> Mon, 29 Jun 2015 14:34:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-append-values-from-a-field-to-all-values-of-a-multivalued/m-p/181576#M52316 woodcock 2015-06-29T14:34:32Z Re: How to append values from a field to all values of a multivalued field? https://community.splunk.com/t5/Splunk-Search/How-to-append-values-from-a-field-to-all-values-of-a-multivalued/m-p/181577#M52317 <P>HI kabiraj<BR /> This search code works well . Try it</P> <PRE><CODE>.......|mvexpand error|rex field=error "(?P&lt;error1&gt;[^\,]+)"|eval error1=error1.":"."TargetBandwidth"|eval error=error1.","|stats values(error) as error </CODE></PRE> <P>Look at an example</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/436i26E4DBA5E3CD5A5A/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Mon, 29 Jun 2015 15:07:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-append-values-from-a-field-to-all-values-of-a-multivalued/m-p/181577#M52317 chimell 2015-06-29T15:07:40Z Re: How to append values from a field to all values of a multivalued field? https://community.splunk.com/t5/Splunk-Search/How-to-append-values-from-a-field-to-all-values-of-a-multivalued/m-p/181578#M52318 <P>Thank You guys for replying. Figured it out myself yesterday. Just a simple mvexpand did the trick. Since woodcock replied first so i m gonna accept his answer. Once again sorry for asking such a dumb question.</P> Tue, 30 Jun 2015 04:58:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-append-values-from-a-field-to-all-values-of-a-multivalued/m-p/181578#M52318 kabiraj 2015-06-30T04:58:56Z Re: How to append values from a field to all values of a multivalued field? https://community.splunk.com/t5/Splunk-Search/How-to-append-values-from-a-field-to-all-values-of-a-multivalued/m-p/181579#M52319 <P>Thank you woodcock. Figured it out myself but thanks for the answer and sorry for the dumb question.</P> Tue, 30 Jun 2015 04:59:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-append-values-from-a-field-to-all-values-of-a-multivalued/m-p/181579#M52319 kabiraj 2015-06-30T04:59:47Z Re: How to append values from a field to all values of a multivalued field? https://community.splunk.com/t5/Splunk-Search/How-to-append-values-from-a-field-to-all-values-of-a-multivalued/m-p/181580#M52320 <P>Thank you chimell. Figured it out yesterday. Only a mvexpand and then mvcombine did the trick. Anyways, sorry for the dumb question.</P> Tue, 30 Jun 2015 05:00:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-append-values-from-a-field-to-all-values-of-a-multivalued/m-p/181580#M52320 kabiraj 2015-06-30T05:00:56Z Re: How to append values from a field to all values of a multivalued field? https://community.splunk.com/t5/Splunk-Search/How-to-append-values-from-a-field-to-all-values-of-a-multivalued/m-p/181581#M52321 <P>I'm trying to do something similar, but the whole reason I am is to try and get around the high memory cost of the mvexpand operation. Any other suggestions?</P> Tue, 16 Oct 2018 19:57:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-append-values-from-a-field-to-all-values-of-a-multivalued/m-p/181581#M52321 johnmccash 2018-10-16T19:57:30Z Re: How to append values from a field to all values of a multivalued field? https://community.splunk.com/t5/Splunk-Search/How-to-append-values-from-a-field-to-all-values-of-a-multivalued/m-p/181582#M52322 <P>@johnmccash please create a new post on this, this question is from 2015 and answered already. I've found very few ways to work around this issue but ask the question in a new post...</P> Tue, 16 Oct 2018 21:55:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-append-values-from-a-field-to-all-values-of-a-multivalued/m-p/181582#M52322 gjanders 2018-10-16T21:55:06Z