Dynamic variable fields generation

[victorsalazar]

Hello Splunk Community

I would like to know if I can create a new column field from a multivalue field

MV field = 

1, 2, 3, 4 

then I have another MV field

a, b,c,d 

after that I want my search result to look like in the pictureq_splunk.png

Thanks in advance

[victorsalazar]

Thanks a lot both answer solved my problem

[ITWhisperer · Accepted solution]

mvzip the two mv fields together, mvexpand to split into multiple events, rex out the two values, eval a new field using one field value for the name and the other field for the value, then use stats to join the events back together

| streamstats count as event_no
| eval combined=mvzip(field1, field2)
| mvexpand combined
| rex field=combined "(?<key>[^,]*),(?<value>.*)"
| eval {key}=value
| stats values(*) as * by event_no

[richgalloway]

You already have two MV fields so it's not clear what field you want to create.

To produce the example output from the example inputs, try this query.

| makeresults | eval x="1,2,3,4", y="a,b,c,d" | eval x=split(x,","), y=split(y,",")
```The above just generates test data```
| eval z=mvzip(y,x)
| mvexpand z
| eval z=split(z,",") | eval h=mvindex(z,0), v=mvindex(z,1)
| fields h,v
| fields - _*
| transpose header_field=h
| fields - column