Splunk Enterprise

I am trying to create a multivalue where I should split the data during the pipe symbol.

gemrose
Explorer

For example if my data is

platform = "operational", task="draft||draft-published",jobstart="2021-06-27T15:46:08.34666||2021-06-27T18:46:08.70000, jobend="2021-06-28T12:86:08.37836||2021-06-28T18:46:08.70990"

I need in the below format. I tried makemv delim="||" task but this happens for only one field. Is there any other option available ?

platformtaskjobstartjobend
operationaldraft2021-06-27T15:46:08.346662021-06-28T12:86:08.37836
operationaldraft-published2021-06-27T18:46:08.700002021-06-28T18:46:08.70990
Labels (1)
0 Karma
1 Solution

danielcj
Communicator

Hello,

Please try the following (The first two lines are just to mock your data as an example):

 

| makeresults 
| eval platform = "operational", task="draft||draft-published",jobstart="2021-06-27T15:46:08.34666||2021-06-27T18:46:08.70000", jobend="2021-06-28T12:86:08.37836||2021-06-28T18:46:08.70990" 
| eval jobstart = split(jobstart, "||"), task = split(task,"||"), jobend = split(jobend,"||") 
| eval multivalue = mvzip(mvzip(task, jobstart), jobend) 
| mvexpand multivalue 
| makemv multivalue delim="," 
| eval task = mvindex(multivalue, 0), jobstart = mvindex(multivalue, 1), jobend = mvindex(multivalue, -1) 
| table platform, task, jobstart, jobend

View solution in original post

gemrose
Explorer

Thank you @danielcj. your solution helped me a lot

 

0 Karma

danielcj
Communicator

Hello,

Please try the following (The first two lines are just to mock your data as an example):

 

| makeresults 
| eval platform = "operational", task="draft||draft-published",jobstart="2021-06-27T15:46:08.34666||2021-06-27T18:46:08.70000", jobend="2021-06-28T12:86:08.37836||2021-06-28T18:46:08.70990" 
| eval jobstart = split(jobstart, "||"), task = split(task,"||"), jobend = split(jobend,"||") 
| eval multivalue = mvzip(mvzip(task, jobstart), jobend) 
| mvexpand multivalue 
| makemv multivalue delim="," 
| eval task = mvindex(multivalue, 0), jobstart = mvindex(multivalue, 1), jobend = mvindex(multivalue, -1) 
| table platform, task, jobstart, jobend
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...