Splunk Search

Transpose function is split multivalue to singlevalue of space delimiter

Engager

Hi.
I am found that Transpose function is split multivalue to singlevalue of space delimiter.

< table >

AAA

BBB

CCC

< table | transpose >

AAA BBB CCC

Can I remain my multivalue?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

You could work around the issue like this:

| stats count | eval value = "foo" | eval multivalue = "foo bar" | makemv multivalue
    | foreach * [eval <<FIELD>> = mvjoin(<<FIELD>>, "#####")] | transpose | foreach row* [makemv "<<FIELD>>" delim="#####"]

First I create a dummy event with an mv field multivalue, that's where your transpose command would be. Now I use foreach to turn every mv field into a regular field, using a delimiter that may not exist elsewhere... do the transpose, and turn each row back into a mv field based on that delimiter.

View solution in original post

SplunkTrust
SplunkTrust

You could work around the issue like this:

| stats count | eval value = "foo" | eval multivalue = "foo bar" | makemv multivalue
    | foreach * [eval <<FIELD>> = mvjoin(<<FIELD>>, "#####")] | transpose | foreach row* [makemv "<<FIELD>>" delim="#####"]

First I create a dummy event with an mv field multivalue, that's where your transpose command would be. Now I use foreach to turn every mv field into a regular field, using a delimiter that may not exist elsewhere... do the transpose, and turn each row back into a mv field based on that delimiter.

View solution in original post

Engager

Yes, It works.
Additionally, before the transposed multivalue that use head 1|table |transpose|makemv delim=" " "row 1". It's not working, but i was use head 1|chat list() over _time|transpose|makemv delim=" " "row 1".
Thank you martin.^^

0 Karma

SplunkTrust
SplunkTrust

Well, the key reason for using foreach here is that you don't need to care about what fields actually are mv fields and how many rows you get after the transpose.

If you do know these things you could replace the foreach with one eval per mv field before the transpose and one makemv per transposed row X field after the transpose.

0 Karma

Revered Legend

Works perfectly fine with Splunk 6.x. Can we achieve the same in Splunk 5.0.5 version (foreach command is not available)?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!