Splunk Enterprise

Multivalue field problem Is there any way to use without "mvexpand"

Kirthika
Path Finder
IDcurr_rowcomparison_result
19Turn onequal
191245equal
191245equal
191245equal
191245equal
191245equal
191245equal
20Turn onnot equal
207656equal
207690not equal
208783equal

 

For the above table, whenever a comparison_result column value is equal to "not equal", it should copy the corresponding whole row value and insert before that row by changing curr_row value alone to "Turn on" without using mvexpand command. I have tried with mvexpand query, memory issue was there.

 

Mvexpand query:

 

| eval row=if(comparison_result=="not equal" AND curr_row!="Turn on",mvrange(0,2),null())
| mvexpand row
| eval curr_row=if(row==0,"Turn on",curr_row)
| fields - row
Labels (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Kirthika 

stats command will give you better performance over mvexpand and memory limitation issues.  Please check below sample search and try to design your search as per requirement. 

| makeresults 
| eval _raw="ID	curr_row	comparison_result
19	Turn on	equal
19	1245	equal
19	1245	equal
19	1245	equal
19	1245	equal
19	1245	equal
19	1245	equal
20	Turn on	not equal
20	7656	equal
20	7690	not equal
20	8783	equal" 
| multikv forceheader=1
| table ID curr_row comparison_result
| rename comment as "Upto now is data generation logic only"
| eval a=1 | accum a
| eval row=if(comparison_result=="not equal" AND curr_row!="Turn on",mvrange(0,2)," ")
| stats c by a ID curr_row comparison_result row
| sort a
| eval curr_row=if(row==0,"Turn on",curr_row)
| table ID curr_row comparison_result

 

I hope this will help you.

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

 

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Kirthika 

stats command will give you better performance over mvexpand and memory limitation issues.  Please check below sample search and try to design your search as per requirement. 

| makeresults 
| eval _raw="ID	curr_row	comparison_result
19	Turn on	equal
19	1245	equal
19	1245	equal
19	1245	equal
19	1245	equal
19	1245	equal
19	1245	equal
20	Turn on	not equal
20	7656	equal
20	7690	not equal
20	8783	equal" 
| multikv forceheader=1
| table ID curr_row comparison_result
| rename comment as "Upto now is data generation logic only"
| eval a=1 | accum a
| eval row=if(comparison_result=="not equal" AND curr_row!="Turn on",mvrange(0,2)," ")
| stats c by a ID curr_row comparison_result row
| sort a
| eval curr_row=if(row==0,"Turn on",curr_row)
| table ID curr_row comparison_result

 

I hope this will help you.

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

 

0 Karma

Kirthika
Path Finder

Thank you @kamlesh_vaghela . It works as expected

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Glad to help you  @Kirthika 

Happy Splunking

 

0 Karma
Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...