topic Create a table from a multivalue field in Splunk Search

Create a table from a multivalue field

maurelio79 — Mon, 19 Feb 2018 11:34:54 GMT

Hi to all, i need to create a table for a multivalue event. Event is like:

field1=value1, field2=value2, field3="valueA,valueB,valueC,"

i need to create a table like

value1, value2, valueA
value1, value2, valueB
value1, value2, valueC

So i need to exapand to multivalue e create a row in the table for each value of field3.
mvexpand seems what i need, but at the and the table is something like:

    value1, value2, valueA
                    valueB
                    valueC

Can someone please help me?

Thanks and regards

Re: Create a table from a multivalue field

493669 — Mon, 19 Feb 2018 11:43:19 GMT

try this:

...|makemv field3 delim=","|mvexpand field3

try this run anywhere search:

|makeresults|eval field1="value1", field2="value2", field3="valueA,valueB,valueC"|makemv field3 delim=","|mvexpand field3

Re: Create a table from a multivalue field

maurelio79 — Mon, 19 Feb 2018 11:57:25 GMT

Nice!! Thanks you! I tried mvexpand or makemv, but not together.
Thanks!