Multivalue Field Formatting Issue in Lookup Export

[Varun18]

Hi Team,

I have a multivalue field in one of the user fields, along with other fields. However, when exporting the data to an external lookup, the multivalue field is converted into a single value, comma-separated value.

For example, in my search, the userid field appears as follows:

userid

890000
pklstu
790000
c_pklstu

However, after exporting to the external lookup, it transforms into:

userid

890000,pklstu,790000,c_pklstu

I need the multivalue field to remain unchanged in the external lookup so that I can accurately compare user IDs with other lookups. I have tried using mvexpand before exporting, but it introduced other challenges.

Is there a way to ensure the multivalue field remains intact while exporting to the external lookup?"

[yuanliu]

---

I need the multivalue field to remain unchanged in the external lookup so that I can accurately compare user IDs with other lookups. I have tried using mvexpand before exporting, but it introduced

---

By making the output a comma-delimited list is exactly keeping the multivalue unchanged.  If userid from other data sources are to match 890000, for example, the only way to do this is to make 890000 on its own row.

If you want concrete help from volunteers, you need to carefully describe your use case.  How is this to "compare user IDs with other lookups?" What does the data look like?  What are symptoms of "problems" caused by mvexpand?  As always, illustrate your point with exact data (anonymize as necessary).

[Varun18]

Hi @yuanliu ,

Thanks for your response.

If the user ID field contains multiple values separated by a delimiter, can it still be used as a lookup field when comparing it with other data that also contains user IDs?

For example, if the field contains four user IDs and one of them exists in another lookup table, the lookup fails because the values are comma-separated.

I would like to understand how to perform a lookup on multiple values separated by a delimiter.

[yuanliu]

---

I would like to understand how to perform a lookup on multiple values separated by a delimiter.

---

As I explained in my initial comment, there is no such match. (I mean, you CAN perform complicated maneuvers with such a table to accomplish matching.  And I have.  But don't call that a lookup.)  Please explain exactly how you are going to use this lookup (using data illustration), AND what exact "problems" does mvexpand cause (again, using data illustration).

[bowesmana]

What do you mean an "external lookup" and how are you exporting it?

Do you mean outputlookup or something else?

[Varun18]

Hi @bowesmana ,

my bad, I meant splunk lookups. I'm using outputlookup command to export search output data to Splunk lookup.

Regards

VK

[bowesmana]

Use 

| outputlookup mycsv.csv output_format=splunk_mv_csv

That keeps the lookup file with proper MV fields.