topic Re: How to expand events that contain multivalue fields into separate events with unique field value pairs? in Splunk Search

How to expand events that contain multivalue fields into separate events with unique field value pairs?

chvnc — Tue, 29 Sep 2020 11:19:26 GMT

The problem here is my actual events are as below
1.event_id=1 name1=x name2=y name3=z responsetime1=4 responsetime2=5 responsetime3=6
2.event_id=2 name1=a name2=b name3=c responsetime1=7 responsetime3=8 responsetime3=9

I need something like this

events
1.event_id=1 name=x responsetime=4
2.event_id=1 name=y responsetime=5
3.event_id=1 name=z responsetime=6
4.event_id=2 name=a responsetime=7
5.event_id=2 name=b responsetime=8
6.event_id=2 name=c responsetime=9

Re: How to expand events that contain multivalue fields into separate events with unique field value pairs?

sundareshr — Thu, 06 Oct 2016 20:09:53 GMT

See if this works

base search 
| rex field=x max_match=0 "event_id=(?<event_id>\d+)" 
| rex field=x max_match=0 "name\d=(?<name>\w+)" 
| rex field=x max_match=0 "responsetime\d=(?<responsetime>\d+)" 
| eval z=mvzip(name, responsetime) 
| mvexpand z 
| rex field=z "(?<name>[^,]+),(?<responsetime>.*)" 
| streamstats count as event_id 
| table event_id name responsetime

Re: How to expand events that contain multivalue fields into separate events with unique field value pairs?

chvnc — Tue, 29 Sep 2020 11:19:29 GMT

I need something like this

events
1.event_id=1 name=x responsetime=4
2.event_id=1 name=y responsetime=5
3.event_id=1 name=z responsetime=6
4.event_id=2 name=a responsetime=7
5.event_id=2 name=x responsetime=8
6.event_id=2 name=x responsetime=9

Re: How to expand events that contain multivalue fields into separate events with unique field value pairs?

sundareshr — Thu, 06 Oct 2016 20:30:37 GMT

Try updated ans