Splunk Search

How to format multi-value table

paulholguin
New Member

I need help formatting a mulitvalue field, the desired output below, followed by data in the field.

For the data in each event, we need 5 field-values in each row, hope this makes sense...

Desired output:

_time Field-Name
2019-09-25 13:45:15.810 000101194,000005090,000000845,000962003
000962000,000962002,000962004,000024909
000962001,000038594
_time Field-Name
2019-09-25 13:47:15.810 000101194,000005090,000000845,000962003
000962000,000962002,000962004,000024909
000962001,000038594,000962004,000024909
Data In field

000101194;000005090;000000845;000962003;000962000;000962002;000962004;000024909;000962001;000038594
000101194;000005090;000000845;000962003;000962000;000962002;000962004;000024909;000962001;000038594;000962001;00003859

0 Karma

paulholguin
New Member

| eval TradingPartnerKPGroupNum=TradingPartnerKPGroupNum + ";"
| makemv tokenizer="(([\d]*[;]){1,5})" TradingPartnerKPGroupNum
| eval TradingPartnerKPGroupNum=rtrim(TradingPartnerKPGroupNum, ";")

0 Karma

Anantha123
Communicator

Try this

query
| eval fieldName = field1+","+field2+","+field3+","+field4+","+field5
| table _time fieldName

0 Karma

paulholguin
New Member

I created this, works well, thanks for you support.

| eval TradingPartnerKPGroupNum=TradingPartnerKPGroupNum + ";"
| makemv tokenizer="(([\d]*[;]){1,5})" TradingPartnerKPGroupNum
| eval TradingPartnerKPGroupNum=rtrim(TradingPartnerKPGroupNum, ";")

0 Karma
Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...