topic Re: How to make a table with multiple multivalue fields? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-make-a-table-with-multiple-multivalue-fields/m-p/31578#M6538 <P>I have tried that. mvexpand is giving each field as one line as <BR /> P_NAME P_value<BR /><BR /> p1 m1<BR /> p2 m2<BR /> p3 m3<BR /> But I cannot figure out how to do one to one mapping of P_NAME and P_ID as I need to draw a chart like <BR /> chart first(P_value) over _time by P_NAME<BR /> Please help.<BR /> Thanks</P> Mon, 28 Sep 2020 13:09:22 GMT disha 2020-09-28T13:09:22Z How to make a table with multiple multivalue fields? https://community.splunk.com/t5/Splunk-Search/How-to-make-a-table-with-multiple-multivalue-fields/m-p/31574#M6534 <P>I need to make a table with some information from events.</P> <P>my event looks like:</P> <P>[timestamp][some info]<BR /><BR /> [function_name_1][id_1][param_1][result_1]<BR /><BR /> [function_name_2][id_2][param_2][result_2]<BR /><BR /> [function_name_3][id_3][param_3][result_3]<BR /><BR /> ...<BR /><BR /> [function_name_n][id_n][param_n][result_n]<BR /></P> <P>Because my regexp only found the first occurance of the fields(function_name,id,param,result) so I used MV_ADD for all multivalue fields and now it finds all occurences.</P> <P>My table should looks like:</P> <P>index |timestamp |some_info |function_name |id |param |result<BR /><BR /> 1 |timestamp |some_info |function_name_1|id_1 |param_1|result_1<BR /><BR /> 2 |timestamp |some_info |function_name_2|id_2 |param_2|result_2<BR /><BR /> 3 |timestamp |some_info |function_name_3|id_3 |param_3|result_3<BR /><BR /> 4 |timestamp |some_info |function_name_4|id_4 |param_4|result_4<BR /></P> <P>problem is with multivalue fields, for the last 4 column in one record I've got couple values and my table looks like:</P> <P>index |timestamp |some_info |function_name |id |param |result<BR /><BR /> 1 |timestamp |some_info |function_name_1|id_1|param_1|result_1<BR /><BR /> | | |function_name_2|id_2|param_2|result_2<BR /><BR /> | | |function_name_3|id_3|param_3|result_3<BR /><BR /> | | |function_name_4|id_4|param_4|result_4<BR /><BR /> 2 |timestamp |some_info |function_name_1|id_1 |param_1|result_1<BR /><BR /> | | |function_name_2|id_2 |param_2|result_2<BR /><BR /> | | |function_name_3|id_3 |param_3|result_3<BR /><BR /> | | |function_name_4|id_4 |param_4|result_4<BR /></P> <P>I read about mvexpand command but it doesn't work good with multiple multivalue fields.<BR /> after mvcommand for all multivalue fields I've got:</P> <P>index |timestamp |some_info |function_name |id |param |result<BR /><BR /> 1 |timestamp |some_info |function_name_1|id_1 |param_1|result_1<BR /><BR /> 2 |timestamp |some_info |function_name_1|id_1 |param_1|result_2<BR /><BR /> 3 |timestamp |some_info |function_name_1|id_1 |param_1|result_3<BR /><BR /> 4 |timestamp |some_info |function_name_1|id_1 |param_1|result_4<BR /><BR /> 5 |timestamp |some_info |function_name_1|id_1 |param_2|result_1<BR /><BR /> 6 |timestamp |some_info |function_name_1|id_1 |param_2|result_2<BR /><BR /> 7 |timestamp |some_info |function_name_1|id_1 |param_2|result_3<BR /><BR /> 8 |timestamp |some_info |function_name_1|id_1 |param_2|result_4<BR /><BR /> 9 |timestamp |some_info |function_name_1|id_1 |param_3|result_1<BR /><BR /> 10 |timestamp |some_info |function_name_1|id_1 |param_3|result_2<BR /><BR /> 11 |timestamp |some_info |function_name_1|id_1 |param_3|result_3<BR /><BR /> ...<BR /><BR /> (n-1) |timestamp |some_info |function_name_4|id_4 |param_4|result_3<BR /><BR /> n |timestamp |some_info |function_name_4|id_4 |param_4|result_4<BR /></P> <P>My last query looks like:</P> <P>"table _time some_info function_name id param result | mvexpand function_name| mvexpand id|mvexpand param |mvexpand result"</P> <P>Could any one help me with this situation.</P> <P>Thanks,<BR /><BR /> Adrian.</P> Fri, 10 Aug 2012 10:25:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-a-table-with-multiple-multivalue-fields/m-p/31574#M6534 aadrian 2012-08-10T10:25:21Z Re: How to make a table with multiple multivalue fields? https://community.splunk.com/t5/Splunk-Search/How-to-make-a-table-with-multiple-multivalue-fields/m-p/31575#M6535 <P>Hi aadrian,</P> <P>I am facing a similiar situation, have you got a solution to this?? even i am struggling to do the same.</P> <P>Thnx</P> Thu, 20 Sep 2012 13:58:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-a-table-with-multiple-multivalue-fields/m-p/31575#M6535 adityapavan18 2012-09-20T13:58:27Z Re: How to make a table with multiple multivalue fields? https://community.splunk.com/t5/Splunk-Search/How-to-make-a-table-with-multiple-multivalue-fields/m-p/31576#M6536 <P>Did You find any solution..Looks like nobody answering multiple multivalued field.I am stucked with the same.</P> Mon, 21 Jan 2013 22:08:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-a-table-with-multiple-multivalue-fields/m-p/31576#M6536 disha 2013-01-21T22:08:35Z Re: How to make a table with multiple multivalue fields? https://community.splunk.com/t5/Splunk-Search/How-to-make-a-table-with-multiple-multivalue-fields/m-p/31577#M6537 <P>I would try to use spath, output the result in a field, and do an mvexpand on that...</P> Tue, 22 Jan 2013 07:09:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-a-table-with-multiple-multivalue-fields/m-p/31577#M6537 sbsbb 2013-01-22T07:09:25Z Re: How to make a table with multiple multivalue fields? https://community.splunk.com/t5/Splunk-Search/How-to-make-a-table-with-multiple-multivalue-fields/m-p/31578#M6538 <P>I have tried that. mvexpand is giving each field as one line as <BR /> P_NAME P_value<BR /><BR /> p1 m1<BR /> p2 m2<BR /> p3 m3<BR /> But I cannot figure out how to do one to one mapping of P_NAME and P_ID as I need to draw a chart like <BR /> chart first(P_value) over _time by P_NAME<BR /> Please help.<BR /> Thanks</P> Mon, 28 Sep 2020 13:09:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-a-table-with-multiple-multivalue-fields/m-p/31578#M6538 disha 2020-09-28T13:09:22Z Re: How to make a table with multiple multivalue fields? https://community.splunk.com/t5/Splunk-Search/How-to-make-a-table-with-multiple-multivalue-fields/m-p/31579#M6539 <P>I'm not sure to understand your problem, I've done something similar with xml.<BR /> In your case, maybe you should extract all information as one field (lets say eField) " |function_name_1|id_1 |param_1|result_1", then mvexpand, and only after that, extract fields out of this eField</P> Mon, 28 Sep 2020 13:09:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-a-table-with-multiple-multivalue-fields/m-p/31579#M6539 sbsbb 2020-09-28T13:09:25Z