Splunk Search

How to iterate over a field with multiple values to produce a new field?

tpirozzi
Explorer

Hi,

I have a test field with multiple values

A
B
C
D
etc...

in my splunk query I want to iterate over that field and build a new field

A@B
B@C
C@D
etc...

Is there a way to accomplish this?
I tried some different things with eval but not able to build that field.

Thanks in advance

Tags (1)
0 Karma
1 Solution

rjthibod
Champion

Use streamstats. This is exactly a use case for it.

Try this assuming your special field is called "MyField" and the new field is "MyField_new"

<YOUR_BASE_SEARCH> 
| streamstats last(MyField) as prev 
| eval MyField_new = MyFields ."@". prev 
| fields - prev

View solution in original post

woodcock
Esteemed Legend

This can also be done with the autoregress command as follows:

<YOUR_BASE_SEARCH> 
| autoregress MyField 
| eval MyField_new = MyFields ."@". MyFields_p1
| fields - MyFields_p1

tpirozzi
Explorer

Thank you too

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi tpirozzi,
could you explain better your need?
Bye.
Giuseppe

0 Karma

tpirozzi
Explorer

Trying to build information for a Sankey Diagram.

0 Karma

rjthibod
Champion

Use streamstats. This is exactly a use case for it.

Try this assuming your special field is called "MyField" and the new field is "MyField_new"

<YOUR_BASE_SEARCH> 
| streamstats last(MyField) as prev 
| eval MyField_new = MyFields ."@". prev 
| fields - prev

tpirozzi
Explorer

Thank you!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...