Splunk Search
Highlighted

How to expand multivalue fields?

Motivator

Hi,

is it possible to split-up/expand an event like this?

field1=xyz
field2=xyz
action: [ [-]
{ [-]
actionserial: 63
action
start: 1427365806891
actionname: A
params: { [+]
}
}
{ [-]
action
serial: 64
actionstart: 1427365812718
action
name: B
params: { [+]
}
}
{ [-]
actionserial: 65
action
startutc: 1427365813260
action
name: A
params: { [+]
}
}
{ [-]
actionserial: 66
action
startutc: 1427365813937
action
name: B
params: { [+]
}
}
{ [-]
actionserial: 67
action
startutc: 1427365831792
action
name: C
params: { [+]

There are 5 actions in the event. I would like to expand this one event into 5 events, where each event includes only one of the actions.

Thanks in advance

Tags (2)
0 Karma
Highlighted

Re: How to expand multivalue fields?

Motivator

Hi try HeinzWaescher
Try this search code

 ............  | eval oneaction_by_event=mvdedup(mvappend(field1 ,field2,action))|mvexpand oneaction_by_event|table oneaction_by_event
0 Karma
Highlighted

Re: How to expand multivalue fields?

Motivator

thanks for your post. unfortunately this approach doesn't show the needed results

0 Karma
Highlighted

Re: How to expand multivalue fields?

Influencer

I would just do a multi-value field extraction, use a table to transform them into separate rows, then do stats/etc. against the table. i.e.

.... | rex "\naction_serial:\s(?<action_serial>\d+)\naction_start:\s(?<action_start>\d+)\naction_name:\s(?<action_name>\w+)" max_match=0 | table action_serial action_start action_name
0 Karma
Highlighted

Re: How to expand multivalue fields?

Motivator

I have tried to set up your file in the variable temp as you peus the contacts below to help get out of a aproche what you veus. and t inspireant my example you will find your answer because it was walking home.
try this example:

| gentimes start=-1 | eval
temp="{\"action_serial\":\" 63\",\"action_start\": \"1427365806891\",\"action_name\": \"A\",\"params\": \"{ [+]}\"},{\"action_serial\":\" 64\",\"action_start\": \"1427365812718\",\"action_name\":\" B\",\"params\": \"{ [+]}\"},{\"action_serial\":\" 65\",\"action_start_utc\": \"1427365813260\",\"action_name\": \"A\",\"params\": \"{ [+]}\"},{\"action_serial\": \"66\",\"action_start_utc\": \"1427365813937\",\"action_name\": \"B\",\"params\":\" { [+]}\"}"| table temp | rename temp as _raw | spath |rename action_* as *|rename action_*utc as *|rename params as parametre | eval temp=mvzip(serial,mvzip(start,mvzip(name,parametre,"#"),"#"),"#")| mvexpand temp|table serial start name  parametre _raw temp
0 Karma
Highlighted

Re: How to expand multivalue fields?

Motivator

We decided to adjust the inputformat. Extracting the fields in every search for this sourcetype was way too complicated.
Thanks for your ideas!

Heinz

View solution in original post

0 Karma