Splunk Enterprise

I am trying to create a multivalue where I should split the data during the pipe symbol.

gemrose
Explorer

For example if my data is

platform = "operational", task="draft||draft-published",jobstart="2021-06-27T15:46:08.34666||2021-06-27T18:46:08.70000, jobend="2021-06-28T12:86:08.37836||2021-06-28T18:46:08.70990"

I need in the below format. I tried makemv delim="||" task but this happens for only one field. Is there any other option available ?

platformtaskjobstartjobend
operationaldraft2021-06-27T15:46:08.346662021-06-28T12:86:08.37836
operationaldraft-published2021-06-27T18:46:08.700002021-06-28T18:46:08.70990
Labels (1)
0 Karma
1 Solution

danielcj
Communicator

Hello,

Please try the following (The first two lines are just to mock your data as an example):

 

| makeresults 
| eval platform = "operational", task="draft||draft-published",jobstart="2021-06-27T15:46:08.34666||2021-06-27T18:46:08.70000", jobend="2021-06-28T12:86:08.37836||2021-06-28T18:46:08.70990" 
| eval jobstart = split(jobstart, "||"), task = split(task,"||"), jobend = split(jobend,"||") 
| eval multivalue = mvzip(mvzip(task, jobstart), jobend) 
| mvexpand multivalue 
| makemv multivalue delim="," 
| eval task = mvindex(multivalue, 0), jobstart = mvindex(multivalue, 1), jobend = mvindex(multivalue, -1) 
| table platform, task, jobstart, jobend

View solution in original post

gemrose
Explorer

Thank you @danielcj. your solution helped me a lot

 

0 Karma

danielcj
Communicator

Hello,

Please try the following (The first two lines are just to mock your data as an example):

 

| makeresults 
| eval platform = "operational", task="draft||draft-published",jobstart="2021-06-27T15:46:08.34666||2021-06-27T18:46:08.70000", jobend="2021-06-28T12:86:08.37836||2021-06-28T18:46:08.70990" 
| eval jobstart = split(jobstart, "||"), task = split(task,"||"), jobend = split(jobend,"||") 
| eval multivalue = mvzip(mvzip(task, jobstart), jobend) 
| mvexpand multivalue 
| makemv multivalue delim="," 
| eval task = mvindex(multivalue, 0), jobstart = mvindex(multivalue, 1), jobend = mvindex(multivalue, -1) 
| table platform, task, jobstart, jobend
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...