Splunk Search

How can I combine multiple fields with a common name results in to single column?

satyaallaparthi
Communicator

How can I combine multiple fields results in to single column with common name for example Test1, Test2, Test3 and so on up to Test 20  with a common word as "Test" in all the fields (either using foreach or any other solution)?

Test1 Test2  Test3 Test4 Test5 Test6 Test7 Test8
               
1 6 11 16 21 26 31 36
2 7 12 17 22 27 32 37
3 8 13 18 23 28 33 38
4 9 14 19 24 29 34 39
5 10 15 20 25 30 35 40

 

Result: 

Test21

1

2

3

4

5

6

7

8

9

so on 

 

Any help would be appreciated. 

Labels (1)
Tags (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

You could do this

| foreach Test* [ eval Data=mvappend(Data, '<<FIELD>>') ]
| stats values(Data) as Data
| mvexpand Data
| sort Data

which will create a new field Data with all the values of the Test* fields and then it depends on what you want to do.

stats will collect all values of fields present into a single row with all values, then mvexpand/sort will expand them all to separate rows. 

If you have duplicate numbers anywhere, they will be removed, so it depends on your output requirements

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

You could do this

| foreach Test* [ eval Data=mvappend(Data, '<<FIELD>>') ]
| stats values(Data) as Data
| mvexpand Data
| sort Data

which will create a new field Data with all the values of the Test* fields and then it depends on what you want to do.

stats will collect all values of fields present into a single row with all values, then mvexpand/sort will expand them all to separate rows. 

If you have duplicate numbers anywhere, they will be removed, so it depends on your output requirements

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...