Splunk Search

How to split results which are combined in a table and export to a csv?

theouhuios
Motivator

Hello

I have few results which look like below in a table command. They are the values which are extracted from the xml data (using rex and mv_add) which has multiple matches in a single event.

    name   number id        emplid
 1  
    aaa    123  897hjhuih   908908 
    bbb    234  hkhkjh      8nknkjn

2
    ahkjhkj      12453  897hj545huih    9089fgfg08 
    bbjdkljsb    23544  hkhk5454jh      8nknkjn54353

I want to split them to separate rows in table so that it considers the results separate while exporting to a csv.

  name        number  id             emplid
1 aaa         123     897hjhuih      908908
2 bbb         234     hkhkjh         8nknkjn
3 ahkjhkj     12453   897hj545huih   9089fgfg08
4 bbjdkljsb   23544   hkhk5454jh     8nknkjn54353

I tried mvexpand and xmlkv but they dont work. Any idea on how to achieve this? How did you approach it when you faced this issue

Tags (2)
1 Solution

theouhuios
Motivator

Got it to work. Used this http://answers.splunk.com/answers/123887/how-to-expand-multiple-multivalue-fields as an idea on how to solve this issue. Works beautifully.

View solution in original post

theouhuios
Motivator

Got it to work. Used this http://answers.splunk.com/answers/123887/how-to-expand-multiple-multivalue-fields as an idea on how to solve this issue. Works beautifully.

Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...