Splunk Search

How can I combine multiple fields with a common name results in to single column?

satyaallaparthi
Communicator

How can I combine multiple fields results in to single column with common name for example Test1, Test2, Test3 and so on up to Test 20  with a common word as "Test" in all the fields (either using foreach or any other solution)?

Test1 Test2  Test3 Test4 Test5 Test6 Test7 Test8
               
1 6 11 16 21 26 31 36
2 7 12 17 22 27 32 37
3 8 13 18 23 28 33 38
4 9 14 19 24 29 34 39
5 10 15 20 25 30 35 40

 

Result: 

Test21

1

2

3

4

5

6

7

8

9

so on 

 

Any help would be appreciated. 

Labels (1)
Tags (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

You could do this

| foreach Test* [ eval Data=mvappend(Data, '<<FIELD>>') ]
| stats values(Data) as Data
| mvexpand Data
| sort Data

which will create a new field Data with all the values of the Test* fields and then it depends on what you want to do.

stats will collect all values of fields present into a single row with all values, then mvexpand/sort will expand them all to separate rows. 

If you have duplicate numbers anywhere, they will be removed, so it depends on your output requirements

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

You could do this

| foreach Test* [ eval Data=mvappend(Data, '<<FIELD>>') ]
| stats values(Data) as Data
| mvexpand Data
| sort Data

which will create a new field Data with all the values of the Test* fields and then it depends on what you want to do.

stats will collect all values of fields present into a single row with all values, then mvexpand/sort will expand them all to separate rows. 

If you have duplicate numbers anywhere, they will be removed, so it depends on your output requirements

Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...