Splunk Search

How to extract multivalue field values without using the mvexpand command?

lpolo
Motivator

I would like to extract the key=value pairs found in a multivalue field, but without doing mvexpand mvfield.

Note: the multivalue field is created with the split command.

For instance result set after split command:

|eval mvfield=split(mvfield,"&")

Result:

timestamp mvfield=(k1=v1, k2=v2, k3=v3...,kn=vn) 

desired result set without using mvexpand:

 timestamp (k1=v1, k2=v2, k3=v3,...,kn=vn

Thanks,
Lp

0 Karma
1 Solution

sundareshr
Legend

Have you looked at extract? Try this

base search | extract pairdelim="&" kvdelim="=" | ...

View solution in original post

sundareshr
Legend

Have you looked at extract? Try this

base search | extract pairdelim="&" kvdelim="=" | ...

lpolo
Motivator

Yeah. I forgot about the extract command. It does the trick.

thanks,
Lp

0 Karma

sundareshr
Legend

Please accept the answer to close it out.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...