Splunk Search

How can I combine multiple fields with a common name results in to single column?

satyaallaparthi
Communicator

How can I combine multiple fields results in to single column with common name for example Test1, Test2, Test3 and so on up to Test 20  with a common word as "Test" in all the fields (either using foreach or any other solution)?

Test1 Test2  Test3 Test4 Test5 Test6 Test7 Test8
               
1 6 11 16 21 26 31 36
2 7 12 17 22 27 32 37
3 8 13 18 23 28 33 38
4 9 14 19 24 29 34 39
5 10 15 20 25 30 35 40

 

Result: 

Test21

1

2

3

4

5

6

7

8

9

so on 

 

Any help would be appreciated. 

Labels (1)
Tags (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

You could do this

| foreach Test* [ eval Data=mvappend(Data, '<<FIELD>>') ]
| stats values(Data) as Data
| mvexpand Data
| sort Data

which will create a new field Data with all the values of the Test* fields and then it depends on what you want to do.

stats will collect all values of fields present into a single row with all values, then mvexpand/sort will expand them all to separate rows. 

If you have duplicate numbers anywhere, they will be removed, so it depends on your output requirements

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

You could do this

| foreach Test* [ eval Data=mvappend(Data, '<<FIELD>>') ]
| stats values(Data) as Data
| mvexpand Data
| sort Data

which will create a new field Data with all the values of the Test* fields and then it depends on what you want to do.

stats will collect all values of fields present into a single row with all values, then mvexpand/sort will expand them all to separate rows. 

If you have duplicate numbers anywhere, they will be removed, so it depends on your output requirements

Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...