Splunk Search

How can I combine multiple fields with a common name results in to single column?

satyaallaparthi
Communicator

How can I combine multiple fields results in to single column with common name for example Test1, Test2, Test3 and so on up to Test 20  with a common word as "Test" in all the fields (either using foreach or any other solution)?

Test1 Test2  Test3 Test4 Test5 Test6 Test7 Test8
               
1 6 11 16 21 26 31 36
2 7 12 17 22 27 32 37
3 8 13 18 23 28 33 38
4 9 14 19 24 29 34 39
5 10 15 20 25 30 35 40

 

Result: 

Test21

1

2

3

4

5

6

7

8

9

so on 

 

Any help would be appreciated. 

Labels (1)
Tags (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

You could do this

| foreach Test* [ eval Data=mvappend(Data, '<<FIELD>>') ]
| stats values(Data) as Data
| mvexpand Data
| sort Data

which will create a new field Data with all the values of the Test* fields and then it depends on what you want to do.

stats will collect all values of fields present into a single row with all values, then mvexpand/sort will expand them all to separate rows. 

If you have duplicate numbers anywhere, they will be removed, so it depends on your output requirements

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

You could do this

| foreach Test* [ eval Data=mvappend(Data, '<<FIELD>>') ]
| stats values(Data) as Data
| mvexpand Data
| sort Data

which will create a new field Data with all the values of the Test* fields and then it depends on what you want to do.

stats will collect all values of fields present into a single row with all values, then mvexpand/sort will expand them all to separate rows. 

If you have duplicate numbers anywhere, they will be removed, so it depends on your output requirements

Get Updates on the Splunk Community!

The Payment Operations Wake-Up Call: Why Financial Institutions Can't Afford ...

The same scenario plays out across financial institutions daily. A payment system fails at 11:30 AM on a busy ...

Make Your Case: A Ready-to-Send Letter for Getting Approval to Attend .conf25

Hello Splunkers, Want to attend .conf25 in Boston this year but not sure how to convince your manager? We've ...

Community Spotlight: A Splunk Expert's Journey

In the world of data analytics, some journeys leave a lasting impact not only on the individual but on the ...