Splunk Enterprise

How can I (or is it even possible to) make arrays out of a and b?

rberman
Path Finder

Suppose I have data as follows:

| makeresults
| eval a = mvappend(a, "\"1\"")
| eval a = mvappend(a, "\"2\"")
| eval a = mvappend(a, "\"3\"")
| eval a = mvappend(a, "\"4\"")
| eval a = mvappend(a, "\"5\"")
| eval b= mvjoin(a, ",")
| table a, b

Using SPL, how can I (or is it even possible to) make arrays out of a and b so that I have fields c=["1","2","3","4","5"]  and d=["1","2","3","4","5"] where c is an array of 5 quoted numerical values and d is an array of 1 single string of the comma separated string: "1","2","3","4","5"

I know I can get arrays of values via extraction from JSON but is there a way to do this without JSON?

Labels (1)
Tags (3)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...