Splunk Search

How to split results which are combined in a table and export to a csv?

theouhuios
Motivator

Hello

I have few results which look like below in a table command. They are the values which are extracted from the xml data (using rex and mv_add) which has multiple matches in a single event.

    name   number id        emplid
 1  
    aaa    123  897hjhuih   908908 
    bbb    234  hkhkjh      8nknkjn

2
    ahkjhkj      12453  897hj545huih    9089fgfg08 
    bbjdkljsb    23544  hkhk5454jh      8nknkjn54353

I want to split them to separate rows in table so that it considers the results separate while exporting to a csv.

  name        number  id             emplid
1 aaa         123     897hjhuih      908908
2 bbb         234     hkhkjh         8nknkjn
3 ahkjhkj     12453   897hj545huih   9089fgfg08
4 bbjdkljsb   23544   hkhk5454jh     8nknkjn54353

I tried mvexpand and xmlkv but they dont work. Any idea on how to achieve this? How did you approach it when you faced this issue

Tags (2)
1 Solution

theouhuios
Motivator

Got it to work. Used this http://answers.splunk.com/answers/123887/how-to-expand-multiple-multivalue-fields as an idea on how to solve this issue. Works beautifully.

View solution in original post

theouhuios
Motivator

Got it to work. Used this http://answers.splunk.com/answers/123887/how-to-expand-multiple-multivalue-fields as an idea on how to solve this issue. Works beautifully.

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...