How do I create a table lookup to have multi line columns

[jsburt]

I have a table lookup to map product numbers to more-readable and usable names.

I would like to be able to map number 272829 to "Joes Widget (round blue)" - where the parenthesized part shows underneath "Joes Widget" in the resultant table.

Is this doable?

What would the string in the CSV file look like?

Thanks

[niketn]

@jsburt could you please add more details on what is (round blue) and why do you need it below "Jows Widget"? Can you add a mock up screenshot of what you need? Also what is the current query that you have?

Once you show the result in the table, is there drilldown configured or is it just for display?

If you create lookup like the following:

number    details
272829    Joes Widget,(round blue)

Or

number    name          tag
272829    Joes Widget   (round blue)

You can still use SPL commands to format output fields to create multivalue results in your table i.e. split() evaluation function or makemv command on details field for first lookup and mvappend, mvjoin command for second lookup.

As requested earlier, for us to assist you better you would need to provide more details on what you current have and what is it exactly that you want (also why you want as well as it will add context to your question).

[woodcock]

You can do this but only by making that field a multi-valued field where each line is another value (you can use rex mode=sed ... | makemv delim=... and many other commands for this). The problem with this is that when you write it out to file-based csv/lookup, Splunk implicitly calls nomv on every field to flatten out each multi-valued field. So you have 3 options:

1: Use a KV-Store based lookup; these support`multi-valued` fields.
2: Encode your `multi-valued` on write ( `mvcombine delim=":::"` ), and decode it on read ( `makemv delim=":::"` ).
3: Expand your  `multi-valued` row on write ( `mvexpand` ), and merge on read ( `stats values(*) AS * BY key_field` ).

[CarsonZa]

If you don't want to change your lookup from its current form try this. My regex may need some tweaking.

| inputlookup test.csv
| rex field=Name "(?<\FieldA>.)\s((?<\FieldB>.))"
| eval combined=mvappend(FieldA,FieldB)
| fields - FieldA, FieldB

Otherwise you can simply add some type of "delimiter" to separate the two pieces like so "Joes Widget - (round blue)". Then in your search | makemv productName delim="-"

Either one of those should display the table i believe you are describing. Leaving your lookup as single line.