Splunk Search

How to split multivalue fields after lookup?

skiourus
New Member

Hello after a search like this:

index=myindex|lookup mycsv.csv host_ip

I have the following output:

alt text

I would like to make it looks like this

alt text

assuming that the criticity is unique per host_ip regardless the number of time it appears.

Any help is welcome thanks.

Tags (3)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi
Can you please try below search??

YOUR_SEARCH
| eval tempField=mvzip(mvzip(host_ip,branch),criticity)
| stats count by _time, tempField 
| eval host_ip=mvindex(split(tempField,","),0), 
    branch=mvindex(split(tempField,","),1),
    criticity=mvindex(split(tempField,","),2)

Thanks

View solution in original post

0 Karma

skiourus
New Member

Thank you all for your solutions.

I finally solved it by this command

index=myindex 
| lookup mycsv.csv host_ip
| stats count by host_ip,branch,criticity
| fields -count

it is time consuming but it does the job!

0 Karma

somesoni2
Revered Legend

Try this

index=myindex|lookup mycsv.csv host_ip
| mvexpand branch | eval criticity=mvdedup(criticity)

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi
Can you please try below search??

YOUR_SEARCH
| eval tempField=mvzip(mvzip(host_ip,branch),criticity)
| stats count by _time, tempField 
| eval host_ip=mvindex(split(tempField,","),0), 
    branch=mvindex(split(tempField,","),1),
    criticity=mvindex(split(tempField,","),2)

Thanks

0 Karma

elliotproebstel
Champion

I think mvexpand should do what you need. Here's some documentation on it:
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Mvexpand

Try adding this to the end of your query:
| mvexpand branch

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...