Compare Lines in a Single Field

[airalee]

Hello All,

Is there a way in a Splunk search to iterate through a multiline field and do stats on each value/each line? The goal is to display only when Field2 has varying lengths of values. So in this case, the result will only display the rows Apples and Bananas.

Example Table:
Field1, Field2 (where \n is an actual newline and not the characters for a newline)
Apples, 12345 \n 123456 \n 1234
Bananas, 123 \n 12345
Oranges, 123456 \n 123456 \n 123456

Thanks!

[to4kawa · Accepted solution]

|makeresults
|eval _raw="Field1, Field2
Apples, 12345 123456 1234
Bananas, 123 12345
Oranges, 123456 123456 123456"
|multikv forceheader=1
|table Field1, Field2
|eval Field2=split(trim(Field2)," ")
|rename COMMENT as "this is sample. from here, the logic"
|eval vary1=mvcount(Field2), vary2=mvcount(mvdedup(Field2))
| where vary1==vary2

[airalee]

Thanks @to4kawa ! This is what I was looking for. I did not realize you can use the mvdedup inside the mvcount, thanks again!

[kamlesh_vaghela]

@airalee

Can you please share your expected output from your shared data?

Meanwhile, you can try below search for getting exact multivalue field.

YOUR_SEARCH
| eval Field2=replace(Field2,"\n",",") 
| makemv delim="," Field2

Sample search for extraction:

| makeresults 
| eval Field1="Apples", Field2="12345
123456
1234" 
| append [| makeresults 
| eval Field1="Bananas", Field2="123
12345" ]
| append [| makeresults 
| eval Field1="Oranges", Field2="123456
123456
123456" ]
| eval Field2=replace(Field2,"\n",",") 
| makemv delim="," Field2

[airalee]

Hi @kamlesh_vaghela , thanks for your help! I got the results from @to4kawa below