- Find Answers
- :
- Splunk Administration
- :
- Admin Other
- :
- Knowledge Management
- :
- Re: How to get same values from mutlivalue field
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
We have below problem data in lookup:
| pan | assestId | item_deviceId | phoneNumber | imeID |
| 11023 | ass#ABC1#man6558962f asst#ABC1#man827631e ite#0#man76451627ahdgs ite#0#man76451627ahd75 | ite#0#man76451627ahdgs | 8763173699 | 123456789 |
| 11023 | ass#ABC1#man6558962f asst#ABC1#man827631e ite#0#man76451627ahdgs ite#0#man76451627ahd75 | ite#0#man76451627ahd75 | 8736628187 | 987654321 |
Now we require new field "Mobile_DeviceId" from "assestId" for identical row.
As per below splunk table:
| pan | assestId | item_deviceId | phoneNumber | imeID | Mobile_DeviceId |
| 11023 | ass#ABC1#man6558962f asst#ABC1#man827631e ite#0#man76451627ahdgs ite#0#man76451627ahd75 | ite#0#man76451627ahdgs | 8763173699 | 123456789 | ass#ABC1#man6558962f |
| 11023 | ass#ABC1#man6558962f asst#ABC1#man827631e ite#0#man76451627ahdgs ite#0#man76451627ahd75 | ite#0#man76451627ahd75 | 8736628187 | 987654321 | asst#ABC1#man827631e |
Is it possible from SPL?? Please help me to create SPL.
My query is:
| inputlookp abc.csv
| table pan assestId item_deviceId phoneNumber imeID
| eval Mobile_DeviceId=split(assestId," ")|mvexpand Mobile_DeviceId| search Mobile_DeviceId=ass#*
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How do you identify which assestId is required as the Mobile_DevideId - assuming that there are an even number of assestIds and the device id in the first part of the list corresponds to the item in the second part of the list e.g. 1st matches with 3rd and 2nd matches with 4th (as in your example), then you could try something like this
| inputlookp abc.csv
| table pan assestId item_deviceId phoneNumber imeID
| eval Mobile_DeviceId=split(assestId," ")
| eval Mobile_DeviceId=mvindex(Mobile_DeviceId,mvfind(Mobile_DeviceId, item_deviceId)%(mvcount(Mobile_DeviceId)/2))- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you so much @ITWhisperer
You are awesome.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How do you identify which assestId is required as the Mobile_DevideId - assuming that there are an even number of assestIds and the device id in the first part of the list corresponds to the item in the second part of the list e.g. 1st matches with 3rd and 2nd matches with 4th (as in your example), then you could try something like this
| inputlookp abc.csv
| table pan assestId item_deviceId phoneNumber imeID
| eval Mobile_DeviceId=split(assestId," ")
| eval Mobile_DeviceId=mvindex(Mobile_DeviceId,mvfind(Mobile_DeviceId, item_deviceId)%(mvcount(Mobile_DeviceId)/2))- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @ITWhisperer ,
What change required in query if we want to swap the value of Mobile_DeviceId?? without applying SORT command
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What do you mean by swap? What result are you trying to achieve?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Swap means switch the value in last column.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
As per below splunk table:
| pan | assestId | item_deviceId | phoneNumber | imeID | Mobile_DeviceId |
| 11023 | ass#ABC1#man6558962f asst#ABC1#man827631e ite#0#man76451627ahdgs ite#0#man76451627ahd75 | ite#0#man76451627ahdgs | 8763173699 | 123456789 | asst#ABC1#man827631e |
| 11023 | ass#ABC1#man6558962f asst#ABC1#man827631e ite#0#man76451627ahdgs ite#0#man76451627ahd75 | ite#0#man76451627ahd75 | 8736628187 | 987654321 | ass#ABC1#man6558962f |
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
| inputlookp abc.csv
| table pan assestId item_deviceId phoneNumber imeID
| eval Mobile_DeviceId=split(assestId," ")
| eval Mobile_DeviceId=mvindex(Mobile_DeviceId,(mvcount(Mobile_DeviceId)/2)-(mvfind(Mobile_DeviceId, item_deviceId)%(mvcount(Mobile_DeviceId)/2)))- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank You @ITWhisperer for your prompt support.
🙂
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
