Splunk Search

How do you create several multivalued fields?

MaryvonneMB
Path Finder

Hi all,

I have several events like this:

Field_A // Field_B // Field_C
A // 1 // z
A // 2 // z
B // 3 // y
B // 4 // x

I would like to create two multivalued fields from Field_B and Field_C relative to Field_A, like this:

Field_A // Field_B // Field_C
A // 1::2 // z
B // 3::4 // y::x

I try mvcombine, but it works only when I have Field_A and Field_B (or Field_A and Field_C). I didn't find how to use it with several fields.

Thank you for any help

0 Karma
1 Solution

niketnilay
Legend

@MaryvonneMB how about

  <yourMainSearch>
  | stats values(Field_B) as Field_B values(Field_C) as Field_C by Field_A
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketnilay
Legend

@MaryvonneMB how about

  <yourMainSearch>
  | stats values(Field_B) as Field_B values(Field_C) as Field_C by Field_A
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

MaryvonneMB
Path Finder

Thank you very much. I didn't though about stats values. I use mvjoin after to add separator I want and it works well 🙂

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...