Splunk Search

Why when I use mvzip , mvexpand, mvindex(split, the first 4 fields keep repeating?

karu0711
Communicator

 

index="main" sourcetype="vrea"
| eval nested_payload=mvzip(info, solution, "---")
| mvexpand nested_payload
| eval info=mvindex(split(nested_payload, "---"), 1)
| eval solution=mvindex(split(nested_payload, "---"), 0)
| eval nested_payload=mvzip(line, more, "---")
| mvexpand nested_payload
| eval line=mvindex(split(nested_payload, "---"), 1)
| eval more=mvindex(split(nested_payload, "---"), 0)
| eval nested_payload=mvzip(ID, Severity, "---")
| mvexpand nested_payload
| eval Severity=mvindex(split(nested_payload, "---"), 1)
| eval CWE_ID=mvindex(split(nested_payload, "---"), 0)
| table info solution ID Severity line more

 

 

when use the SPL my table fields value first 4 fields keep repeating same value but last 2 field "line and more" correct value? 

anyone know why it is happening?

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It sounds like mvexpand is doing exactly what it is supposed to do, that is, create duplicate events except for the field being expanded, which will contain each of the values in the multi-value field in separate events.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Please explain the question with sample data and sample output, then explain why you feel the output is wrong.  Otherwise it's just a waste of time for others to try to speculate what the question really is.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...