Transpose function is split multivalue to singlevalue of space delimiter

[kbluech]

Hi.
I am found that Transpose function is split multivalue to singlevalue of space delimiter.

< table >

AAA

BBB

CCC

< table | transpose >

AAA BBB CCC

Can I remain my multivalue?

[martin_mueller · Accepted solution]

You could work around the issue like this:

| stats count | eval value = "foo" | eval multivalue = "foo bar" | makemv multivalue
    | foreach * [eval <<FIELD>> = mvjoin(<<FIELD>>, "#####")] | transpose | foreach row* [makemv "<<FIELD>>" delim="#####"]

First I create a dummy event with an mv field multivalue, that's where your transpose command would be. Now I use foreach to turn every mv field into a regular field, using a delimiter that may not exist elsewhere... do the transpose, and turn each row back into a mv field based on that delimiter.

[kbluech]

Yes, It works.
Additionally, before the transposed multivalue that use head 1|table |transpose|makemv delim=" " "row 1". It's not working, but i was use head 1|chat list() over _time|transpose|makemv delim=" " "row 1".
Thank you martin.^^

[martin_mueller]

Well, the key reason for using foreach here is that you don't need to care about what fields actually are mv fields and how many rows you get after the transpose.

If you do know these things you could replace the foreach with one eval per mv field before the transpose and one makemv per transposed row X field after the transpose.

[somesoni2]

Works perfectly fine with Splunk 6.x. Can we achieve the same in Splunk 5.0.5 version (foreach command is not available)?