Knowledge Management

How to get same values from mutlivalue field?

dhirendra761
Contributor

Hi, 

 We have below problem data in lookup: 

pan assestId item_deviceId phoneNumber imeID
11023 ass#ABC1#man6558962f asst#ABC1#man827631e ite#0#man76451627ahdgs ite#0#man76451627ahd75 ite#0#man76451627ahdgs 8763173699 123456789
11023 ass#ABC1#man6558962f asst#ABC1#man827631e ite#0#man76451627ahdgs ite#0#man76451627ahd75  ite#0#man76451627ahd75 8736628187 987654321

 

Now we require new field "Mobile_DeviceId" from "assestId"  for identical row.

As per below splunk table:

pan assestId item_deviceId phoneNumber imeID Mobile_DeviceId
11023 ass#ABC1#man6558962f asst#ABC1#man827631e ite#0#man76451627ahdgs ite#0#man76451627ahd75 ite#0#man76451627ahdgs 8763173699 123456789 ass#ABC1#man6558962f
11023 ass#ABC1#man6558962f asst#ABC1#man827631e ite#0#man76451627ahdgs ite#0#man76451627ahd75  ite#0#man76451627ahd75 8736628187 987654321 asst#ABC1#man827631e

 

Is it possible from SPL?? Please help me to create SPL.

My query is:

 

 

| inputlookp abc.csv
| table pan assestId item_deviceId phoneNumber imeID
| eval Mobile_DeviceId=split(assestId," ")|mvexpand Mobile_DeviceId| search Mobile_DeviceId=ass#* 

 

 

 

Labels (2)
Tags (1)
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

How do you identify which assestId is required as the Mobile_DevideId - assuming that there are an even number of assestIds and the device id in the first part of the list corresponds to the item in the second part of the list e.g. 1st matches with 3rd and 2nd matches with 4th (as in your example), then you could try something like this

| inputlookp abc.csv
| table pan assestId item_deviceId phoneNumber imeID
| eval Mobile_DeviceId=split(assestId," ")
| eval Mobile_DeviceId=mvindex(Mobile_DeviceId,mvfind(Mobile_DeviceId, item_deviceId)%(mvcount(Mobile_DeviceId)/2))

View solution in original post

dhirendra761
Contributor

Thank you so much @ITWhisperer

You are awesome.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

How do you identify which assestId is required as the Mobile_DevideId - assuming that there are an even number of assestIds and the device id in the first part of the list corresponds to the item in the second part of the list e.g. 1st matches with 3rd and 2nd matches with 4th (as in your example), then you could try something like this

| inputlookp abc.csv
| table pan assestId item_deviceId phoneNumber imeID
| eval Mobile_DeviceId=split(assestId," ")
| eval Mobile_DeviceId=mvindex(Mobile_DeviceId,mvfind(Mobile_DeviceId, item_deviceId)%(mvcount(Mobile_DeviceId)/2))

dhirendra761
Contributor

Hi @ITWhisperer ,

What change required  in query if we want to swap the value of Mobile_DeviceId?? without applying SORT command

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What do you mean by swap? What result are you trying to achieve?

0 Karma

dhirendra761
Contributor

Swap means switch the value in last column.

 

0 Karma

dhirendra761
Contributor

As per below splunk table:

panassestIditem_deviceIdphoneNumberimeIDMobile_DeviceId
11023ass#ABC1#man6558962f asst#ABC1#man827631e ite#0#man76451627ahdgs ite#0#man76451627ahd75ite#0#man76451627ahdgs8763173699123456789asst#ABC1#man827631e
11023ass#ABC1#man6558962f asst#ABC1#man827631e ite#0#man76451627ahdgs ite#0#man76451627ahd75 ite#0#man76451627ahd758736628187987654321

ass#ABC1#man6558962f

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| inputlookp abc.csv
| table pan assestId item_deviceId phoneNumber imeID
| eval Mobile_DeviceId=split(assestId," ")
| eval Mobile_DeviceId=mvindex(Mobile_DeviceId,(mvcount(Mobile_DeviceId)/2)-(mvfind(Mobile_DeviceId, item_deviceId)%(mvcount(Mobile_DeviceId)/2)))

dhirendra761
Contributor

Thank You @ITWhisperer  for your prompt support. 

🙂

0 Karma
Get Updates on the Splunk Community!

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out >> 🏆 Check out the ...

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...