Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Multi Field values into Single field value
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I need help in getting multiple field values into single field to compare it and get the match if any.
For example, I have Field 1, Field 2, and so on till Field 10 and similarly each field is having unique value. I need to check if any of the value is matching with other events and get that value.
Please help on this and let me know if more info needed.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
To combine all fields in to 1 , you can try below query
| eval output=(mvappend(field1, field2, field3, field4, field5, field6, field7, field8, field9, field10)) | mvexpand output | dedup output | table output
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
To combine all fields in to 1 , you can try below query
| eval output=(mvappend(field1, field2, field3, field4, field5, field6, field7, field8, field9, field10)) | mvexpand output | dedup output | table output
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This worked, thanks a lot.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The output should not be the concatenated value of all field values, It should unique value only. Because I need to compare each value with other events values to get the matched one using the same value in different activities and get them out from that.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you show some example events and the expected output?
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
My log would have multiple user ids: userid1: "value"; userid2: "value" and so on. Here I need to get the userid value and compare it with other events to identify the same user id has been used in different activities/ multiple times.
The output would be like:
User ID Activity Count(Activity)
Let me know if this is helpful.
Observe and Secure All Apps with Splunk
Splunk Decoded: Business Transactions vs Business IQ
Fastest way to demo Observability
