Archive
Highlighted

How do you create several multivalued fields?

Path Finder

Hi all,

I have several events like this:

FieldA // FieldB // Field_C
A // 1 // z
A // 2 // z
B // 3 // y
B // 4 // x

I would like to create two multivalued fields from FieldB and FieldC relative to Field_A, like this:

FieldA // FieldB // Field_C
A // 1::2 // z
B // 3::4 // y::x

I try mvcombine, but it works only when I have FieldA and FieldB (or FieldA and FieldC). I didn't find how to use it with several fields.

Thank you for any help

0 Karma
Highlighted

Re: How do you create several multivalued fields?

Legend

@MaryvonneMB how about

  <yourMainSearch>
  | stats values(Field_B) as Field_B values(Field_C) as Field_C by Field_A



| eval message="Happy Splunking!!!"


View solution in original post

Highlighted

Re: How do you create several multivalued fields?

Path Finder

Thank you very much. I didn't though about stats values. I use mvjoin after to add separator I want and it works well 🙂