paste is an extremely useful unix command. I want to use that very feature to merge three multivalue fields in exactly the way paste can work with multiple fields. Maybe there is another way that I have not imagined. Maybe someone has written something like unix paste for Splunk already?
My issue:
After my rex max_match=0 extraction I have three multivalue columns with exactly the same number of elements each. The number of elements varies from event to event.
I want to 'combine' the results along the lines of : (note that ColA, ColB, ColC below are all multivalue)
.. | table _time ColA ColB ColC | eval z0=mvindex(ColA,0) + ":" + mvindex(ColB,0) + ":" + mvindex(ColC ,0)
| eval z1=mvindex(ColA,1) + ":" + mvindex(ColB,1) + ":" + mvindex(ColC ,1)|eval z=mvzip(z0,z1)|makemv delim="," z
Graphically this looks like this :
ColA ColB ColC z
type1 27 random type1:27:random
type1 37 words type1:37:words
type2 P228 of type2:P228:of
other1 anytext course other1:anytext:course
anytext twenty fun anytext:twenty:fun
This would be fine if there were always the exact same number of values in the mv fields from event to event. My inexperience in syntax and option means I have come up blan kafter a few hours reading questions and answers. And I simply can't get my head past 'paste' which I thought might be implemented as something like 'mvpaste' - alas no.
Would the mvzip command help here? It takes 2 multivalue fields and "pairs" them up as per your example. (see http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/CommonEvalFunctions for mvzip example)
This previous answer shows how to make it work with 3 or more items.
http://answers.splunk.com/answers/130571/three-are-more-multiple-value-for-mvzip.html
eval zipped = mvzip(mvzip(mv_a, mv_b, delim_ab), mv_c, delim_bc)
Would the mvzip command help here? It takes 2 multivalue fields and "pairs" them up as per your example. (see http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/CommonEvalFunctions for mvzip example)
This previous answer shows how to make it work with 3 or more items.
http://answers.splunk.com/answers/130571/three-are-more-multiple-value-for-mvzip.html
eval zipped = mvzip(mvzip(mv_a, mv_b, delim_ab), mv_c, delim_bc)
You are right of course. I had seen that early on - in one of my versions of extract - and discounted it as I must have done something wrong and got the wrong result. This not only does what I imagined but it's named more appropriately as well! Such a shame my first post for help is a poor showing on my part. thanks again though for your answer and guidance!