Splunk Search

Fill Multiple values in a field

Jazzyb
New Member

I have some numeric values that is coming from job search results and the result is saved in tokens. These values are numeric. How can I make bar chart to see whether values are increasing or decreasing. Example 

Value 1 = 100

value 2 = 200

value 3 = 300
 
Now, how can I assign multiple values to a field with the help of eval like this we do for single value 

| eval new_field = “value1’’.. instead of one value I want to keep multiple values. Thanks 

Labels (1)
0 Karma

Jazzyb
New Member

thanks but this solves my half problem. The values are treated as string here and my values are numbers and based on these numbers, I will create a bar graph. These values are basically  total count from csv files. Each file will generate a Total count and these counts are stored in token. And based on these token values I will create a bar graph. Also tonumber(string) does not convert the entire field to integer.. 

New_Field

100

200

300

So above will be the data. New_Field will have 3 values and I want to make graph based on these values.. 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Do you mean a multi-value field?

| eval new_field=mvappend(value1,value2,value3)

Or do you want separate events for each token value?

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...