Splunk Search

Simple way to turn multivalue field into a table?

alexander_lucas
Explorer

Is the a function that does this:

... | mvmap data (fname, lname, age, height) | table lname, age

(where data is a multivalue field)

Tags (2)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

No. You probably need something like:

... | fields lname age | eval z=mvzip(lname,age,":") | mvexpand z | eval z=split(z,":") | eval lname=mvindex(z,0) | eval age=mvindex(z,1) | fields - z

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

No. You probably need something like:

... | fields lname age | eval z=mvzip(lname,age,":") | mvexpand z | eval z=split(z,":") | eval lname=mvindex(z,0) | eval age=mvindex(z,1) | fields - z

View solution in original post

_jgpm_
Communicator
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.