Splunk Search

How to split multivalue fields after lookup?

skiourus
New Member

Hello after a search like this:

index=myindex|lookup mycsv.csv host_ip

I have the following output:

alt text

I would like to make it looks like this

alt text

assuming that the criticity is unique per host_ip regardless the number of time it appears.

Any help is welcome thanks.

Tags (3)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi
Can you please try below search??

YOUR_SEARCH
| eval tempField=mvzip(mvzip(host_ip,branch),criticity)
| stats count by _time, tempField 
| eval host_ip=mvindex(split(tempField,","),0), 
    branch=mvindex(split(tempField,","),1),
    criticity=mvindex(split(tempField,","),2)

Thanks

View solution in original post

0 Karma

skiourus
New Member

Thank you all for your solutions.

I finally solved it by this command

index=myindex 
| lookup mycsv.csv host_ip
| stats count by host_ip,branch,criticity
| fields -count

it is time consuming but it does the job!

0 Karma

somesoni2
Revered Legend

Try this

index=myindex|lookup mycsv.csv host_ip
| mvexpand branch | eval criticity=mvdedup(criticity)

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi
Can you please try below search??

YOUR_SEARCH
| eval tempField=mvzip(mvzip(host_ip,branch),criticity)
| stats count by _time, tempField 
| eval host_ip=mvindex(split(tempField,","),0), 
    branch=mvindex(split(tempField,","),1),
    criticity=mvindex(split(tempField,","),2)

Thanks

0 Karma

elliotproebstel
Champion

I think mvexpand should do what you need. Here's some documentation on it:
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Mvexpand

Try adding this to the end of your query:
| mvexpand branch

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>