Splunk Search

How do you MVZIP more than one field?

brajaram
Communicator

My data is in JSON format, and contains arrays of JSON data that can be from 1 to N blocks. In this JSON, fields can have the same value across the blocks.

If I have 3 multivalue fields across those blocks, how do I combine them? With mvzip, I can combine two. This lets me parse out the specific value for another value.

FieldA                    FieldB                    FieldC
Quick                     Brown                     Fox
Jumped                    Brown                     Fox
Over                      Brown                     The

So if I wanted to find all values of FieldA that corresponded to Brown Fox, then I want to be able to zip up FIeldA+FieldB+FieldC, then look for the specific combination of Brown and Fox. For 2 fields, I have done this with mvzip. How do I do this with three fields?

Tags (3)
0 Karma
1 Solution

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval FieldA="Quick,Jumped,Over", FieldB="Brown,Brown,Brown", FieldC="Fox,Fox,The" 
| makemv delim="," FieldA 
| makemv delim="," FieldB 
| makemv delim="," FieldC 
| stats list(FieldA) as FieldA,list(FieldB) as FieldB,list(FieldC) as FieldC 
| eval temp=mvzip(FieldA,mvzip(FieldB,FieldC))

View solution in original post

jaxjohnny2000
Builder

I know this is an old topic, but i recently had the same issue.  So maybe it will help someone else. 

the mvzip takes 2 required and one optional parameter.  You can only combine two fields at a time, followed by any character as a delimiter.  in the example below, I use a pipe character |

But i have discovered, you can nest the mvzip and then extract them out

so for your example using FieldA, FieldB, and FieldC

A simple mvzip would be:
| eval combined_data=mvzip(FieldA,FieldB,"|")

and that's it, but wait there's more, proceed with nesting

| eval combined_data=mvzip(mvzip(FieldA,FieldB,"|"),FieldC,"|")

next expand the mv field

| mvexpand combined_data

Finally, extract the fields in the same order you combined them:

| rex field=combined_data "^(?<FieldA>[^|]*)\|(?<FieldB>[^|]*)\|(?<FieldC>[^|]*)"

 

 

 

 

 

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval FieldA="Quick,Jumped,Over", FieldB="Brown,Brown,Brown", FieldC="Fox,Fox,The" 
| makemv delim="," FieldA 
| makemv delim="," FieldB 
| makemv delim="," FieldC 
| stats list(FieldA) as FieldA,list(FieldB) as FieldB,list(FieldC) as FieldC 
| eval temp=mvzip(FieldA,mvzip(FieldB,FieldC))

brajaram
Communicator

Thanks for the help. I didn't realize I could use mvzip inside of an mvzip. Once I did that, it worked fine to find the specific cases we needed. Thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...