Splunk Search

How to Push a Value onto a MultiValue field

DerekKing
Path Finder

Hi,

I would like to be able to push a new value into a multi-valued field, from another field.

ie.
Field1="Derek"
mvfield2="Paul" "Dave" "Bill"

I'd like to be able to do something like mvfield2=mvfield2 + Field1

It looks like I maybe able to get around it by converting the multivalued field to a delimited string, adding the value of field1, then make a new multivalued field, but that seems a long way around what seems like something simple.

Does anyone have any better ideas ?

Thanks for the help
Derek

1 Solution

somesoni2
Revered Legend

You can use "mvappend" function with eval to do this in one step.

runanywhere sample

| gentimes start=-1 | eval field1="Dave" | eval field2=split("Rob,Bob,John",",") | table field* | eval field3=mvappend(field2,field1)

View solution in original post

somesoni2
Revered Legend

You can use "mvappend" function with eval to do this in one step.

runanywhere sample

| gentimes start=-1 | eval field1="Dave" | eval field2=split("Rob,Bob,John",",") | table field* | eval field3=mvappend(field2,field1)

DerekKing
Path Finder

Thanks - Not sure how I missed that!

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...