Splunk Search

How come I can't get mvdedup and mvexpand commands to work properly?

rajim
Path Finder

I have a query where I'm using mvexpand and mvdedup commands to extract some records and calculate related values. But unfortunately both the commands are not working properly. Below is the example what I'm getting. Can anybody please help me understand what's going wrong.

Query:

| inputlookup cee_dlp_base_report.csv
| table _time, User_Name, Detail_File_Size_MB
| mvexpand Detail_File_Size_MB 
| eval User_Name = mvdedup(User_Name)

alt text

alt text

0 Karma

jkat54
SplunkTrust
SplunkTrust

You need to add a ‘|makemv fieldName’

0 Karma

jkat54
SplunkTrust
SplunkTrust

Only you have two fields that need expand so you need to combine them into one field first.

| inputlookup ...
| eval a=mvzip(field1,field2)
| makemv a
| mvexpand a
| eval b=mvindex(a,0)
| eval c=mvindex(a,1)
| table b c

0 Karma

FrankVl
Ultra Champion

Looks like those fields are not actually multi valued. When you hover over them with your mousepointer, do you get highlights for the individual lines, or just for the whole event row together?

0 Karma

rajim
Path Finder

yes you are right. Whenever we are writing the multivalued fields into a csv file, the fields are converting into single value with all multivalued grouped. That's why mvdedup and mvexpand is not working. Thank you for pointing this.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@rajim

Both User_Name & Detail_File_Size_MB multivalued fields? And what is the relation between them. If there is a relation then can you please try below search for work around?

| inputlookup cee_dlp_base_report.csv  | eval temp=mvzip(User_Name, Detail_File_Size_MB)
 | mvexpand temp
 | eval User_Name = mvindex(split(temp,","),0), Detail_File_Size_MB = mvindex(split(temp,","),1)
 | table _time, User_Name, Detail_File_Size_MB

For further analysis, can you please share sample data from lookup file?

0 Karma

rajim
Path Finder

No this is not helpful, as described below. Anyway thank you for your answer.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!