Splunk Search

How to convert a field value containing a list of fields into the values of those fields

dmillis
Splunk Employee
Splunk Employee

Consider a field value which contains a list of comma-separated field names, such as 'fieldList' in this example:

| makeresults
| eval host="server42"
| eval location="dallas"
| eval temp="50"
| eval color="blue"
| eval fieldList="temp,host,color"

I want to create a new field containing the concatenated values of the fields in 'fieldList', like this:

| eval concatenatedValue = temp . host . color

... which, in this example, would result in 'concatenatedValue' containing a value of "50server42blue". 

The next event might have fieldList="location,temp,host", which would need to evaluated in a similar fashion.

Any suggestions?

Labels (2)
0 Karma
1 Solution

dmillis
Splunk Employee
Splunk Employee

Based on the solution posted by @ITWhisperer , here is the final approach I am using:

| makeresults
| eval host="server42"
| eval location="dallas"
| eval temp="50"
| eval color="blue"
| eval fieldList="host,,  temp color"
| rex mode=sed field=fieldList "s/\s+/,/g"
| eval mvfieldList=split(fieldList, ",")
| foreach * [ eval value=if(in("<<FIELD>>",mvfieldList), mvappend(value,<<FIELD>>), value) ]
| eval concatenated=mvjoin(value," - ")

This loads the values into 'concatenated' in alphabetical fieldname order (from 'fieldList'), rather than in the order listed in 'fieldList', but this is OK for my use case (since it will be consistent).

Thanks to @ITWhisperer and @renjith_nair for responding!

View solution in original post

0 Karma

dmillis
Splunk Employee
Splunk Employee

Based on the solution posted by @ITWhisperer , here is the final approach I am using:

| makeresults
| eval host="server42"
| eval location="dallas"
| eval temp="50"
| eval color="blue"
| eval fieldList="host,,  temp color"
| rex mode=sed field=fieldList "s/\s+/,/g"
| eval mvfieldList=split(fieldList, ",")
| foreach * [ eval value=if(in("<<FIELD>>",mvfieldList), mvappend(value,<<FIELD>>), value) ]
| eval concatenated=mvjoin(value," - ")

This loads the values into 'concatenated' in alphabetical fieldname order (from 'fieldList'), rather than in the order listed in 'fieldList', but this is OK for my use case (since it will be consistent).

Thanks to @ITWhisperer and @renjith_nair for responding!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| eval host="server42"
| eval location="dallas"
| eval temp="50"
| eval color="blue"
| eval fieldList="temp,host,color|location,temp,host"
| eval fieldList=split(fieldList,"|")
| mvexpand fieldList
| fields - _time
| foreach * [ eval name=mvappend(name,"<<FIELD>>") | eval value=mvappend(value,<<FIELD>>) ]
| eval fieldList=split(fieldList,",")
| eval concatenated=mvjoin(mvmap(fieldList,mvindex(value,mvfind(name,fieldList))),"")
| fields - name value

dmillis
Splunk Employee
Splunk Employee

Nicely done, @ITWhisperer !  This absolutely works.

0 Karma

renjith_nair
Legend

Try

| makeresults
| eval host="server42"
| eval location="dallas"
| eval temp="50"
| eval color="blue"
| eval fieldList="temp,host,color"
| eval concatenatedValue =mvjoin(split(fieldList,","),".")

 

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

dmillis
Splunk Employee
Splunk Employee

Alas, still only produces field names-- not the field values

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

ITWhisperer_0-1605639093491.png

 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...