Splunk Search

How can I combine multiple fields with a common name results in to single column?

satyaallaparthi
Communicator

How can I combine multiple fields results in to single column with common name for example Test1, Test2, Test3 and so on up to Test 20  with a common word as "Test" in all the fields (either using foreach or any other solution)?

Test1 Test2  Test3 Test4 Test5 Test6 Test7 Test8
               
1 6 11 16 21 26 31 36
2 7 12 17 22 27 32 37
3 8 13 18 23 28 33 38
4 9 14 19 24 29 34 39
5 10 15 20 25 30 35 40

 

Result: 

Test21

1

2

3

4

5

6

7

8

9

so on 

 

Any help would be appreciated. 

Labels (1)
Tags (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

You could do this

| foreach Test* [ eval Data=mvappend(Data, '<<FIELD>>') ]
| stats values(Data) as Data
| mvexpand Data
| sort Data

which will create a new field Data with all the values of the Test* fields and then it depends on what you want to do.

stats will collect all values of fields present into a single row with all values, then mvexpand/sort will expand them all to separate rows. 

If you have duplicate numbers anywhere, they will be removed, so it depends on your output requirements

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

You could do this

| foreach Test* [ eval Data=mvappend(Data, '<<FIELD>>') ]
| stats values(Data) as Data
| mvexpand Data
| sort Data

which will create a new field Data with all the values of the Test* fields and then it depends on what you want to do.

stats will collect all values of fields present into a single row with all values, then mvexpand/sort will expand them all to separate rows. 

If you have duplicate numbers anywhere, they will be removed, so it depends on your output requirements

Get Updates on the Splunk Community!

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...

AppDynamics is now part of Splunk Ideas

Hello Splunkers, We have exciting news for you! AppDynamics has been added to the Splunk Ideas Portal. Which ...

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...