Splunk Search

How do you create several multivalued fields?

MaryvonneMB
Path Finder

Hi all,

I have several events like this:

Field_A // Field_B // Field_C
A // 1 // z
A // 2 // z
B // 3 // y
B // 4 // x

I would like to create two multivalued fields from Field_B and Field_C relative to Field_A, like this:

Field_A // Field_B // Field_C
A // 1::2 // z
B // 3::4 // y::x

I try mvcombine, but it works only when I have Field_A and Field_B (or Field_A and Field_C). I didn't find how to use it with several fields.

Thank you for any help

0 Karma
1 Solution

niketn
Legend

@MaryvonneMB how about

  <yourMainSearch>
  | stats values(Field_B) as Field_B values(Field_C) as Field_C by Field_A
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@MaryvonneMB how about

  <yourMainSearch>
  | stats values(Field_B) as Field_B values(Field_C) as Field_C by Field_A
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

MaryvonneMB
Path Finder

Thank you very much. I didn't though about stats values. I use mvjoin after to add separator I want and it works well 🙂

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...