Splunk Search

Is there a unix-style 'paste' in Splunk to merge three multivalue fields?

pclewis
Explorer

paste is an extremely useful unix command. I want to use that very feature to merge three multivalue fields in exactly the way paste can work with multiple fields. Maybe there is another way that I have not imagined. Maybe someone has written something like unix paste for Splunk already?

My issue:
After my rex max_match=0 extraction I have three multivalue columns with exactly the same number of elements each. The number of elements varies from event to event.
I want to 'combine' the results along the lines of : (note that ColA, ColB, ColC below are all multivalue)

.. | table _time ColA ColB ColC | eval z0=mvindex(ColA,0) + ":" + mvindex(ColB,0) + ":" + mvindex(ColC ,0)
| eval z1=mvindex(ColA,1) + ":" + mvindex(ColB,1) + ":" + mvindex(ColC ,1)|eval z=mvzip(z0,z1)|makemv delim="," z

Graphically this looks like this :

ColA      ColB        ColC        z
type1     27          random      type1:27:random
type1     37          words       type1:37:words
type2     P228        of          type2:P228:of
other1    anytext     course      other1:anytext:course
anytext   twenty      fun         anytext:twenty:fun

This would be fine if there were always the exact same number of values in the mv fields from event to event. My inexperience in syntax and option means I have come up blan kafter a few hours reading questions and answers. And I simply can't get my head past 'paste' which I thought might be implemented as something like 'mvpaste' - alas no.

Tags (2)
0 Karma
1 Solution

sduff_splunk
Splunk Employee
Splunk Employee

Would the mvzip command help here? It takes 2 multivalue fields and "pairs" them up as per your example. (see http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/CommonEvalFunctions for mvzip example)

This previous answer shows how to make it work with 3 or more items.
http://answers.splunk.com/answers/130571/three-are-more-multiple-value-for-mvzip.html

eval zipped = mvzip(mvzip(mv_a, mv_b, delim_ab), mv_c, delim_bc)

View solution in original post

sduff_splunk
Splunk Employee
Splunk Employee

Would the mvzip command help here? It takes 2 multivalue fields and "pairs" them up as per your example. (see http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/CommonEvalFunctions for mvzip example)

This previous answer shows how to make it work with 3 or more items.
http://answers.splunk.com/answers/130571/three-are-more-multiple-value-for-mvzip.html

eval zipped = mvzip(mvzip(mv_a, mv_b, delim_ab), mv_c, delim_bc)

pclewis
Explorer

You are right of course. I had seen that early on - in one of my versions of extract - and discounted it as I must have done something wrong and got the wrong result. This not only does what I imagined but it's named more appropriately as well! Such a shame my first post for help is a poor showing on my part. thanks again though for your answer and guidance!

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...