Splunk Search

Is there a unix-style 'paste' in Splunk to merge three multivalue fields?

pclewis
Explorer

paste is an extremely useful unix command. I want to use that very feature to merge three multivalue fields in exactly the way paste can work with multiple fields. Maybe there is another way that I have not imagined. Maybe someone has written something like unix paste for Splunk already?

My issue:
After my rex max_match=0 extraction I have three multivalue columns with exactly the same number of elements each. The number of elements varies from event to event.
I want to 'combine' the results along the lines of : (note that ColA, ColB, ColC below are all multivalue)

.. | table _time ColA ColB ColC | eval z0=mvindex(ColA,0) + ":" + mvindex(ColB,0) + ":" + mvindex(ColC ,0)
| eval z1=mvindex(ColA,1) + ":" + mvindex(ColB,1) + ":" + mvindex(ColC ,1)|eval z=mvzip(z0,z1)|makemv delim="," z

Graphically this looks like this :

ColA      ColB        ColC        z
type1     27          random      type1:27:random
type1     37          words       type1:37:words
type2     P228        of          type2:P228:of
other1    anytext     course      other1:anytext:course
anytext   twenty      fun         anytext:twenty:fun

This would be fine if there were always the exact same number of values in the mv fields from event to event. My inexperience in syntax and option means I have come up blan kafter a few hours reading questions and answers. And I simply can't get my head past 'paste' which I thought might be implemented as something like 'mvpaste' - alas no.

Tags (2)
0 Karma
1 Solution

sduff_splunk
Splunk Employee
Splunk Employee

Would the mvzip command help here? It takes 2 multivalue fields and "pairs" them up as per your example. (see http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/CommonEvalFunctions for mvzip example)

This previous answer shows how to make it work with 3 or more items.
http://answers.splunk.com/answers/130571/three-are-more-multiple-value-for-mvzip.html

eval zipped = mvzip(mvzip(mv_a, mv_b, delim_ab), mv_c, delim_bc)

View solution in original post

sduff_splunk
Splunk Employee
Splunk Employee

Would the mvzip command help here? It takes 2 multivalue fields and "pairs" them up as per your example. (see http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/CommonEvalFunctions for mvzip example)

This previous answer shows how to make it work with 3 or more items.
http://answers.splunk.com/answers/130571/three-are-more-multiple-value-for-mvzip.html

eval zipped = mvzip(mvzip(mv_a, mv_b, delim_ab), mv_c, delim_bc)

pclewis
Explorer

You are right of course. I had seen that early on - in one of my versions of extract - and discounted it as I must have done something wrong and got the wrong result. This not only does what I imagined but it's named more appropriately as well! Such a shame my first post for help is a poor showing on my part. thanks again though for your answer and guidance!

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...