Splunk Search

Returning the value and position of items in a multivalue field

dcparker
Path Finder

Hello,
I have a field a:
1039275019, 138262333, 20232307, 175653, 63, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0

I would like to return a table with the index and value of each item. For example:
1 1039275019
2 138262333
3 20232307
4 20232307
5 175653

and etc.

Can anyone help with this? If you wondering, the field is coming from cassandra via jmx, so I don't have tons of control over it.

thanks!

1 Solution

somesoni2
Revered Legend

Try this.

<your base search giving field say myfield> | eval myfield=split(myfield,",") | mvexpand myfield | eval sno=1 | accum sno

OR

<your base search giving field say myfield> | eval myfield=split(myfield,",") | mvexpand myfield | streamstats count as sno

View solution in original post

somesoni2
Revered Legend

Try this.

<your base search giving field say myfield> | eval myfield=split(myfield,",") | mvexpand myfield | eval sno=1 | accum sno

OR

<your base search giving field say myfield> | eval myfield=split(myfield,",") | mvexpand myfield | streamstats count as sno

dcparker
Path Finder

thanks, that works!

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...