Splunk Search

How do you create several multivalued fields?

MaryvonneMB
Path Finder

Hi all,

I have several events like this:

Field_A // Field_B // Field_C
A // 1 // z
A // 2 // z
B // 3 // y
B // 4 // x

I would like to create two multivalued fields from Field_B and Field_C relative to Field_A, like this:

Field_A // Field_B // Field_C
A // 1::2 // z
B // 3::4 // y::x

I try mvcombine, but it works only when I have Field_A and Field_B (or Field_A and Field_C). I didn't find how to use it with several fields.

Thank you for any help

0 Karma
1 Solution

niketn
Legend

@MaryvonneMB how about

  <yourMainSearch>
  | stats values(Field_B) as Field_B values(Field_C) as Field_C by Field_A
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@MaryvonneMB how about

  <yourMainSearch>
  | stats values(Field_B) as Field_B values(Field_C) as Field_C by Field_A
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

MaryvonneMB
Path Finder

Thank you very much. I didn't though about stats values. I use mvjoin after to add separator I want and it works well 🙂

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...