Knowledge Management

How to get same values from mutlivalue field?

dhirendra761
Contributor

Hi, 

 We have below problem data in lookup: 

pan assestId item_deviceId phoneNumber imeID
11023 ass#ABC1#man6558962f asst#ABC1#man827631e ite#0#man76451627ahdgs ite#0#man76451627ahd75 ite#0#man76451627ahdgs 8763173699 123456789
11023 ass#ABC1#man6558962f asst#ABC1#man827631e ite#0#man76451627ahdgs ite#0#man76451627ahd75  ite#0#man76451627ahd75 8736628187 987654321

 

Now we require new field "Mobile_DeviceId" from "assestId"  for identical row.

As per below splunk table:

pan assestId item_deviceId phoneNumber imeID Mobile_DeviceId
11023 ass#ABC1#man6558962f asst#ABC1#man827631e ite#0#man76451627ahdgs ite#0#man76451627ahd75 ite#0#man76451627ahdgs 8763173699 123456789 ass#ABC1#man6558962f
11023 ass#ABC1#man6558962f asst#ABC1#man827631e ite#0#man76451627ahdgs ite#0#man76451627ahd75  ite#0#man76451627ahd75 8736628187 987654321 asst#ABC1#man827631e

 

Is it possible from SPL?? Please help me to create SPL.

My query is:

 

 

| inputlookp abc.csv
| table pan assestId item_deviceId phoneNumber imeID
| eval Mobile_DeviceId=split(assestId," ")|mvexpand Mobile_DeviceId| search Mobile_DeviceId=ass#* 

 

 

 

Labels (2)
Tags (1)
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

How do you identify which assestId is required as the Mobile_DevideId - assuming that there are an even number of assestIds and the device id in the first part of the list corresponds to the item in the second part of the list e.g. 1st matches with 3rd and 2nd matches with 4th (as in your example), then you could try something like this

| inputlookp abc.csv
| table pan assestId item_deviceId phoneNumber imeID
| eval Mobile_DeviceId=split(assestId," ")
| eval Mobile_DeviceId=mvindex(Mobile_DeviceId,mvfind(Mobile_DeviceId, item_deviceId)%(mvcount(Mobile_DeviceId)/2))

View solution in original post

dhirendra761
Contributor

Thank you so much @ITWhisperer

You are awesome.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

How do you identify which assestId is required as the Mobile_DevideId - assuming that there are an even number of assestIds and the device id in the first part of the list corresponds to the item in the second part of the list e.g. 1st matches with 3rd and 2nd matches with 4th (as in your example), then you could try something like this

| inputlookp abc.csv
| table pan assestId item_deviceId phoneNumber imeID
| eval Mobile_DeviceId=split(assestId," ")
| eval Mobile_DeviceId=mvindex(Mobile_DeviceId,mvfind(Mobile_DeviceId, item_deviceId)%(mvcount(Mobile_DeviceId)/2))

dhirendra761
Contributor

Hi @ITWhisperer ,

What change required  in query if we want to swap the value of Mobile_DeviceId?? without applying SORT command

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What do you mean by swap? What result are you trying to achieve?

0 Karma

dhirendra761
Contributor

Swap means switch the value in last column.

 

0 Karma

dhirendra761
Contributor

As per below splunk table:

panassestIditem_deviceIdphoneNumberimeIDMobile_DeviceId
11023ass#ABC1#man6558962f asst#ABC1#man827631e ite#0#man76451627ahdgs ite#0#man76451627ahd75ite#0#man76451627ahdgs8763173699123456789asst#ABC1#man827631e
11023ass#ABC1#man6558962f asst#ABC1#man827631e ite#0#man76451627ahdgs ite#0#man76451627ahd75 ite#0#man76451627ahd758736628187987654321

ass#ABC1#man6558962f

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| inputlookp abc.csv
| table pan assestId item_deviceId phoneNumber imeID
| eval Mobile_DeviceId=split(assestId," ")
| eval Mobile_DeviceId=mvindex(Mobile_DeviceId,(mvcount(Mobile_DeviceId)/2)-(mvfind(Mobile_DeviceId, item_deviceId)%(mvcount(Mobile_DeviceId)/2)))

dhirendra761
Contributor

Thank You @ITWhisperer  for your prompt support. 

🙂

0 Karma
Get Updates on the Splunk Community!

Best Strategies to Optimize Observability Costs

 Join us on Tuesday, May 6, 2025, at 11 AM PDT / 2 PM EDT for an insightful session on optimizing ...

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...