topic Re: multivalues in field in Splunk Search

multivalues in field

ken_t_huang — Wed, 15 Jun 2011 03:28:51 GMT

I have a data like this:

NUM=001,Rules="Food Water"

NUM=002,Rules="Water Product"

NUM=003,Rules="Water"

NUM=004,Rules="Product"

NUM=005,Rules="Water Product"

and when I pick the field for "Rules", it shows:

rules (categorical)
Top 10 values of rules
Value               #     %
**Water Product     2     40%
Food Water          1     20%
Water               1     20%
Product             1     20%**

how can I show the correct category? like below:

rules (categorical)
Top 10 values of rules
Value       #     %
**Water     4     50%
Product     3     37.5%
Food        1     12.5%**

please kindly help this issue, thanks.

Re: multivalues in field

sideview — Wed, 15 Jun 2011 06:05:42 GMT

This should work to turn the Rules field into a multivalue field.

<your search> | makemv delim=" " Rules

http://www.splunk.com/base/Documentation/latest/SearchReference/makemv

Or you dont want to use the search language to do it, you can read about how to configure the Rules field to automatically become extracted as a multivalued field. http://www.splunk.com/base/Documentation/4.2.1/Knowledge/ConfigureSplunktoparsemulti-valuefields

Re: multivalues in field

ken_t_huang — Wed, 15 Jun 2011 06:18:04 GMT

hi nick, thanks you answer, I think set configure is better, but I don't know clear about this configure, could you give me an example? thanks