Archive

Multi Field values into Single field value

Explorer

I need help in getting multiple field values into single field to compare it and get the match if any.

For example, I have Field 1, Field 2, and so on till Field 10 and similarly each field is having unique value. I need to check if any of the value is matching with other events and get that value.

Please help on this and let me know if more info needed.

Tags (1)
0 Karma
1 Solution

Communicator

Hi,

To combine all fields in to 1 , you can try below query

| eval output=(mvappend(field1, field2, field3, field4, field5, field6, field7, field8, field9, field10)) | mvexpand output | dedup output | table output

View solution in original post

Communicator

Hi,

To combine all fields in to 1 , you can try below query

| eval output=(mvappend(field1, field2, field3, field4, field5, field6, field7, field8, field9, field10)) | mvexpand output | dedup output | table output

View solution in original post

Explorer

This worked, thanks a lot.

0 Karma

Explorer

The output should not be the concatenated value of all field values, It should unique value only. Because I need to compare each value with other events values to get the matched one using the same value in different activities and get them out from that.

0 Karma

SplunkTrust
SplunkTrust

Can you show some example events and the expected output?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Explorer

My log would have multiple user ids: userid1: "value"; userid2: "value" and so on. Here I need to get the userid value and compare it with other events to identify the same user id has been used in different activities/ multiple times.

The output would be like:
User ID Activity Count(Activity)

Let me know if this is helpful.

0 Karma