Splunk Search

Multivalue Field Formatting Issue in Lookup Export

Varun18
Loves-to-Learn

Hi Team,

I have a multivalue field in one of the user fields, along with other fields. However, when exporting the data to an external lookup, the multivalue field is converted into a single value, comma-separated value.

For example, in my search, the userid field appears as follows:

userid

890000
pklstu
790000
c_pklstu

However, after exporting to the external lookup, it transforms into:

userid

890000,pklstu,790000,c_pklstu

I need the multivalue field to remain unchanged in the external lookup so that I can accurately compare user IDs with other lookups. I have tried using mvexpand before exporting, but it introduced other challenges.

Is there a way to ensure the multivalue field remains intact while exporting to the external lookup?"

 

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

I need the multivalue field to remain unchanged in the external lookup so that I can accurately compare user IDs with other lookups. I have tried using mvexpand before exporting, but it introduced

By making the output a comma-delimited list is exactly keeping the multivalue unchanged.  If userid from other data sources are to match 890000, for example, the only way to do this is to make 890000 on its own row.

If you want concrete help from volunteers, you need to carefully describe your use case.  How is this to "compare user IDs with other lookups?" What does the data look like?  What are symptoms of "problems" caused by mvexpand?  As always, illustrate your point with exact data (anonymize as necessary).

0 Karma

Varun18
Loves-to-Learn

Hi @yuanliu ,

Thanks for your response.

If the user ID field contains multiple values separated by a delimiter, can it still be used as a lookup field when comparing it with other data that also contains user IDs?

For example, if the field contains four user IDs and one of them exists in another lookup table, the lookup fails because the values are comma-separated.

I would like to understand how to perform a lookup on multiple values separated by a delimiter.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

I would like to understand how to perform a lookup on multiple values separated by a delimiter.


As I explained in my initial comment, there is no such match. (I mean, you CAN perform complicated maneuvers with such a table to accomplish matching.  And I have.  But don't call that a lookup.)  Please explain exactly how you are going to use this lookup (using data illustration), AND what exact "problems" does mvexpand cause (again, using data illustration).

0 Karma

bowesmana
SplunkTrust
SplunkTrust

What do you mean an "external lookup" and how are you exporting it?

Do you mean outputlookup or something else?

0 Karma

Varun18
Loves-to-Learn

Hi @bowesmana ,

my bad, I meant splunk lookups. I'm using outputlookup command to export search output data to Splunk lookup.

Regards

VK

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Use 

| outputlookup mycsv.csv output_format=splunk_mv_csv

That keeps the lookup file with proper MV fields.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...

Customer success is front and center at .conf25

Hi Splunkers, If you are not able to be at .conf25 in person, you can still learn about all the latest news ...

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...