Splunk Search

Create Single Field and Multifield Values Based on Same Fields

whitefang1726
Path Finder

Hi Splunkers,

How can I create a single value field based on multiple fields? Also, let's assume that the field names can be 

sample_1_country_1_name to sample_99_country_1_name and sample_1_country_1_name to sample_1_country_99_name. 

Example:

sample_1_country sample_2_country sample_99_country sample_37_country
Denmark Chile Thailand Croatia


Result
sample_country_name
Denmark, Chile, Thailand, Croatia

Thanks!

 

Labels (3)
0 Karma

whitefang1726
Path Finder

Nice, that works sir! Apologies, I just need to update the sample data to avoid oversharing of work items. We have a lot of this fields in our environment. Do you think this is possible using transforms and props? Thanks!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The problem with using made-up fake field names is that any proposed solution might not match your actual usecase. However, here is a solution using the names you provided - hopefully you will get the idea and be able to adapt it to your actual usecase

| makeresults format=csv data="sample_1_country,sample_2_country,sample_99_country,sample_37_country
Denmark,Chile,Thailand,Croatia"
| foreach sample_*_country
    [| eval sample_country_name=if(isnull(sample_country_name),<<FIELD>>,mvappend(sample_country_name,<<FIELD>>))]
| eval sample_country_name=mvjoin(sample_country_name,",")

 

 

Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...