Splunk Search

How to append values from a field to all values of a multivalued field?

Path Finder

Hi All,

I have a multivalued field. I want to take values from one field and append the same to all the values of a multivalued field. The number of values present in multivalued field is NOT constant.

Example: I have a multivalued field as error=0,8000,80001, and so on.
( want to append values from a field such as 'TargetBandwidth' to all values like error=0:targetbandwidth, 8000:targetbandwidth, 8001:targetbandwidth, and so on.

Any ideas on how to do that?

Tried eval error = error+":"+TargetBandwidth but it didn't work.
Tried with eval error = mvappend(error,TargetBandwidth) but it appends values only to the last value of the mv field like error=0, 8000, 8001, and so on:targetbandwidth.

Please help.

0 Karma
1 Solution

Esteemed Legend

Try this:

... | mvexpand error | eval error = error . ":" . TargetBandwidth | mvcombine error

View solution in original post

Path Finder

Thank You guys for replying. Figured it out myself yesterday. Just a simple mvexpand did the trick. Since woodcock replied first so i m gonna accept his answer. Once again sorry for asking such a dumb question.

0 Karma

Motivator

HI kabiraj
This search code works well . Try it

.......|mvexpand error|rex field=error  "(?P<error1>[^\,]+)"|eval error1=error1.":"."TargetBandwidth"|eval error=error1.","|stats  values(error) as error

Look at an example

alt text

0 Karma

Path Finder

Thank you chimell. Figured it out yesterday. Only a mvexpand and then mvcombine did the trick. Anyways, sorry for the dumb question.

0 Karma

Explorer

I'm trying to do something similar, but the whole reason I am is to try and get around the high memory cost of the mvexpand operation. Any other suggestions?

0 Karma

SplunkTrust
SplunkTrust

@johnmccash please create a new post on this, this question is from 2015 and answered already. I've found very few ways to work around this issue but ask the question in a new post...

0 Karma

Esteemed Legend

Try this:

... | mvexpand error | eval error = error . ":" . TargetBandwidth | mvcombine error

View solution in original post

Path Finder

Thank you woodcock. Figured it out myself but thanks for the answer and sorry for the dumb question.

0 Karma