Splunk Search

Flatten out several multivalue fields to a single value and just be like a row/line entry

jaysonpryde
Path Finder

Good day,

As mentioned, I wanted to flatten a series of multivalue fields, and make it just like single row entries, where the type will become "String" and not "Multivalue". To be clearer, here's my base search:

| makeresults 
| eval a="this,is"
| eval b="an,example"
| eval c="group1,group2"
| makemv delim="," a
| makemv delim="," b
| makemv delim="," c
| stats values(a) as a, values(b) as b by c
| eval type_a=typeof(a)
| eval type_b=typeof(b)

result of this will be:
1.png

so what I wanted to do is make the result like this:

cabtype_atype_b
group1isanStringString
group1thisexampleStringString
group2isanStringString
group3thisexampleStringString
     

 

When i add this to the base search:

 mvexpand a
| mvexpand b
| eval type_c=typeof(a)
| eval type_d=typeof(b)

the output will be:

2.png

As you can see, this was able to handle the requirement in making the entries as "String". However,  it has created unnecessary combinations (as compared to my expected output), given that "a" and "b" are multivalue fields.

I am not sure if the way I'll state this is correct, but perhaps, what I wanted is to expand/remove the "grouping" nature, but still output/display it as a single line/row entry like in a CSV file.

An option to handle this is just output the results into a CSV or JSON file, and do the processing away from Splunk, but doing everything inside Splunk is included in my requirement.

Thanks a lot in advance, and as always, any ideas are greatly appreciated

Labels (2)
Tags (1)
1 Solution

sideview
SplunkTrust
SplunkTrust

The way I'd do this is to use mvzip to temporarily glue the "is" and "an" entry together, and the "this" and the "example" entry together.  

This SPL on the end of your run-anywhere example gets you the end result you're looking for:

| eval temp=mvzip(a,b,"::::")
| mvexpand temp
| eval temp = split(temp,"::::")
| eval a=mvindex(temp,0),b=mvindex(temp,1)
| fields - temp
| eval type_a=typeof(a)
| eval type_b=typeof(b)

 

View solution in original post

sideview
SplunkTrust
SplunkTrust

The way I'd do this is to use mvzip to temporarily glue the "is" and "an" entry together, and the "this" and the "example" entry together.  

This SPL on the end of your run-anywhere example gets you the end result you're looking for:

| eval temp=mvzip(a,b,"::::")
| mvexpand temp
| eval temp = split(temp,"::::")
| eval a=mvindex(temp,0),b=mvindex(temp,1)
| fields - temp
| eval type_a=typeof(a)
| eval type_b=typeof(b)

 

View solution in original post

jaysonpryde
Path Finder

Thanks a lot @sideview , and yes, I actually just validated now that it's one way of doing it. Thanks a lot again!

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!