How to produce a csv based on a complex business logic?

[danielbb]

We have a Splunk UI that allows the users to export a certain set of the rows from a lookup. The caveat is that each row might produce multiple output rows with quite a complex logic.

So, I wonder whether to use the mv set of functions maybe coupled with the map command or to develop a python function to do it.

Any suggestions? 

[gcusello]

Hi @danielbb,

as @starcher said, I'd use a python script as the last solution to your need, unless you are a super python expert, and probably I'd avoid in every case!

I'd create a search using all your rules and with this search I'd create a report or a dashboard.

Ciao.

Giusppe

[danielbb]

@gcusello @starcher 

Thank you for your feedback.

We have a lookup that has the following data and we present it to our users via a dashboard - 

number of boxes, customer name, address
3	Alan D.		6 Pixel Rd. TX
5	Yusuf A.	11 Apple Ave. FL
3	Michele Y. 	9 Monitor Lake IL

The dashboard user will have a button to create an exportable csv. Based on the number of boxes, the exportable csv will have three rows for Alan, five for Yusuf and three for Michele with their addresses.

Can we do it with SPL?

[gcusello]

Hi @danielbb,

you could create a dashboard with a dropdown input that permits to choose the customer_name and then displays the rows of the lookup related to that name.

then you can export it in csv using the export button in Splunk panels or your custom script.

Ciao.

Giuseppe

[johnhuang · Accepted solution]

Use mvrange to generate a multivalue field with a value for each box, then use mvexpand to create one row for each value.

| makeresults | eval events="3,Alan D.,6 Pixel Rd. TX;5,Yusuf A.,11 Apple Ave. FL;3,Michele Y.,9 Monitor Lake IL"
| eval events=split(events, ";") | mvexpand events
| rex field=events "^(?<num_of_boxes>[^\,]*)\,(?<customer_name>[^\,]*)\,(?<address>[^\,]*)"
| eval item_num=mvrange(1, num_of_boxes+1)
| mvexpand item_num
| table num_of_boxes customer_name address item_num

[danielbb]

Thank you @johnhuan - really neat !!!

[starcher]

Use python. Multi value manipulation can be complex and fragile. With various limitations you will find the hard way.