Splunk Search

Create multivalued field in the search based on another field

hmahendrakumar
Path Finder

I wantto create a multivalued field bar based on the value of an existing field foo in each event. For example:

if we have these two events:

event1 foo=3
event2 foo=5

then i should create something like this

event1 foo=3 bar=1,2,3
event2 foo=5 bar=1,2,3,4,5
0 Karma

fox
Path Finder

what are potentially the min and max values that foo can be? This could also decide the approach...?

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

it might be helpful if you elaborated on what you intend to do with such a multivalued field. it's possible that whatever your ultimate goal is, it might be possible to achieve more directly without going through this generation of a field?

0 Karma

hmahendrakumar
Path Finder
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...