Splunk Search

How to extract multivalue field values without using the mvexpand command?

lpolo
Motivator

I would like to extract the key=value pairs found in a multivalue field, but without doing mvexpand mvfield.

Note: the multivalue field is created with the split command.

For instance result set after split command:

|eval mvfield=split(mvfield,"&")

Result:

timestamp mvfield=(k1=v1, k2=v2, k3=v3...,kn=vn) 

desired result set without using mvexpand:

 timestamp (k1=v1, k2=v2, k3=v3,...,kn=vn

Thanks,
Lp

0 Karma
1 Solution

sundareshr
Legend

Have you looked at extract? Try this

base search | extract pairdelim="&" kvdelim="=" | ...

View solution in original post

sundareshr
Legend

Have you looked at extract? Try this

base search | extract pairdelim="&" kvdelim="=" | ...

lpolo
Motivator

Yeah. I forgot about the extract command. It does the trick.

thanks,
Lp

0 Karma

sundareshr
Legend

Please accept the answer to close it out.

0 Karma
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...