Splunk Search

Is it possible to turn a multivalued field with an arbitrary number of elements into columns?

responsys_cm
Builder

I have a search that generates two fields -- host and application. Application is a multivalued field with varying numbers of results. Assume the field is comma delimited in the example below. It looks something like:

host application

server1 splunk,apache,named

server2 apache,tomcat

I would like to convert it into the following column format:

host application1 application2 application3 application4...
server1 splunk apache named
server2 apache tomcat

I know I can use eval and mvindex to manually create each column name and then transpose them, but without some kind of for loop, I would have to create a search with the eval statements up to the maximum mvindex value I expect to see.

Is there any way to do this without having to manually create each new column name?

Thx.

0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this

your current search giving host, application | eval temp=mvrange(1,mvcount(application)+1) | rex field=temp mode=sed "s/(\d+)/application\1/g" | eval temp=mvzip(temp,application,"#") | mvexpand temp | table host temp | rex field=temp "(?<type>\w+)#(?<application>.*)" | chart values(application) over host by type limit=0

View solution in original post

pretzel2
Path Finder

Awesome search!     Thank you VERY much. 

0 Karma

somesoni2
Revered Legend

Try something like this

your current search giving host, application | eval temp=mvrange(1,mvcount(application)+1) | rex field=temp mode=sed "s/(\d+)/application\1/g" | eval temp=mvzip(temp,application,"#") | mvexpand temp | table host temp | rex field=temp "(?<type>\w+)#(?<application>.*)" | chart values(application) over host by type limit=0

_jgpm_
Communicator

Very powerful transaction. This should be a native command.

0 Karma

responsys_cm
Builder

Let no one ever say you aren't a Splunk ninja. Thank you so much!

Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...