Splunk Search

Split Multiple MV Fields with Different Number of Values

mistydennis
Communicator

I have 4 mv fields, some with different number of values, all with no visible delimiter.

My search:

    | inputlookup foo
    | search DocID=1234 
    | table DocID, mvfield1, mvfield2, mvfield3, mvfield4

Returns:

DocID     mvfield1     mvfield2     mvfield3     mvfield4
1234       date1        name1        object1      time1
           date2        name2        object2      time2
                        name3        object3

How do I eval the query so that I get results that show the data on separate rows:

1234  date1  name1  object1  time1
1234  date2  name2  object2  time2
1234         name3  object3
Tags (2)
0 Karma

woodcock
Esteemed Legend

You can use mvexpand to do this but, IMHO, you should keep it the way that it is or add this to the end:

| nomv mvfield1 | nomv mvfield2 | nomv mvfield3 | nomv mvfield4
0 Karma

mistydennis
Communicator

@woodcock, I agree - mvexpand is messy with this query. I've never used nomv, so I'll give that a try - is there a way to add a delimiter between the values that are now in one field? It would be nice to have them separated by a pipe or a semicolon.

0 Karma

woodcock
Esteemed Legend

Sure, you can do this instead:

... | foreach mvfield* [ eval <<FIELD>> = mvjoin(<<FIELD>>, "|") ]
0 Karma

mistydennis
Communicator

I know this should work but it doesn't. I just keep getting blank results for the fields. Beginning to wonder if there's something broken with our data.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...