Splunk Search

How can i create new fields with data from two different multi value fields?

mauricio_sandov
Explorer

I need to break out log data from two separate multi-value fields into single value fields. Here is what data looks like:

Screenshot 2023-09-19 at 12.00.11 PM.png

 Each line of data from "participants{}.object_value" corresponds to the line in "participants{}.role" and I would like named victims and offender fields.  I dont understand how to use the mv commands to expand the data from two different fields and then combine them into new fields.

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Once multi-value fields are expanded, any relationship among them is lost.  They need to be combined into a new field before expansion.

...
| eval new_field = mvzip("participants{}.object_value", "participants{}.role")
| mvexpand new_field
| eval new_field = split(new_field, ",")
| eval object_value = mvindex(new_field, 0), role = mvindex(new_field, 1)

The mvzip function combines two multi-value fields, separating them with a comma.  The split function later on breaks the field on the comma.  If you have more than two fields to combine, use nested mvzip functions.

| eval new_field = mvzip(field1, mvzip(field2, mvzip(field3, field4)))

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Once multi-value fields are expanded, any relationship among them is lost.  They need to be combined into a new field before expansion.

...
| eval new_field = mvzip("participants{}.object_value", "participants{}.role")
| mvexpand new_field
| eval new_field = split(new_field, ",")
| eval object_value = mvindex(new_field, 0), role = mvindex(new_field, 1)

The mvzip function combines two multi-value fields, separating them with a comma.  The split function later on breaks the field on the comma.  If you have more than two fields to combine, use nested mvzip functions.

| eval new_field = mvzip(field1, mvzip(field2, mvzip(field3, field4)))

 

---
If this reply helps you, Karma would be appreciated.

mauricio_sandov
Explorer

Thank you this worked and did what I needed

mauricio_sandov
Explorer

I will give this a shot to see what I get. thx

0 Karma
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...