Splunk Search
Highlighted

How to Push a Value onto a MultiValue field

Path Finder

Hi,

I would like to be able to push a new value into a multi-valued field, from another field.

ie.
Field1="Derek"
mvfield2="Paul" "Dave" "Bill"

I'd like to be able to do something like mvfield2=mvfield2 + Field1

It looks like I maybe able to get around it by converting the multivalued field to a delimited string, adding the value of field1, then make a new multivalued field, but that seems a long way around what seems like something simple.

Does anyone have any better ideas ?

Thanks for the help
Derek

0 Karma
Highlighted

Re: How to Push a Value onto a MultiValue field

SplunkTrust
SplunkTrust

You can use "mvappend" function with eval to do this in one step.

runanywhere sample

| gentimes start=-1 | eval field1="Dave" | eval field2=split("Rob,Bob,John",",") | table field* | eval field3=mvappend(field2,field1)

View solution in original post

Highlighted

Re: How to Push a Value onto a MultiValue field

Path Finder

Thanks - Not sure how I missed that!

0 Karma