Flatten out several multivalue fields to a single value and just be like a row/line entry

[jaysonpryde]

Good day,

As mentioned, I wanted to flatten a series of multivalue fields, and make it just like single row entries, where the type will become "String" and not "Multivalue". To be clearer, here's my base search:

| makeresults 
| eval a="this,is"
| eval b="an,example"
| eval c="group1,group2"
| makemv delim="," a
| makemv delim="," b
| makemv delim="," c
| stats values(a) as a, values(b) as b by c
| eval type_a=typeof(a)
| eval type_b=typeof(b)

result of this will be:

so what I wanted to do is make the result like this:

c	a	b	type_a	type_b
group1	is	an	String	String
group1	this	example	String	String
group2	is	an	String	String
group3	this	example	String	String

When i add this to the base search:

 mvexpand a
| mvexpand b
| eval type_c=typeof(a)
| eval type_d=typeof(b)

the output will be:

As you can see, this was able to handle the requirement in making the entries as "String". However,  it has created unnecessary combinations (as compared to my expected output), given that "a" and "b" are multivalue fields.

I am not sure if the way I'll state this is correct, but perhaps, what I wanted is to expand/remove the "grouping" nature, but still output/display it as a single line/row entry like in a CSV file.

An option to handle this is just output the results into a CSV or JSON file, and do the processing away from Splunk, but doing everything inside Splunk is included in my requirement.

Thanks a lot in advance, and as always, any ideas are greatly appreciated

[sideview · Accepted solution]

The way I'd do this is to use mvzip to temporarily glue the "is" and "an" entry together, and the "this" and the "example" entry together.  

This SPL on the end of your run-anywhere example gets you the end result you're looking for:

| eval temp=mvzip(a,b,"::::")
| mvexpand temp
| eval temp = split(temp,"::::")
| eval a=mvindex(temp,0),b=mvindex(temp,1)
| fields - temp
| eval type_a=typeof(a)
| eval type_b=typeof(b)

[jaysonpryde]

Thanks a lot @sideview , and yes, I actually just validated now that it's one way of doing it. Thanks a lot again!