Splunk Search

create a multivalue field, based on multiple single value fields with the same field name

fsiemons
Engager

Hi there, I have a bit of a tough one.

I have a log with multiple entries of the same field, basically a list of values. I am trying to merge these values into a single new field, with a line for every value that was in the RAW event.

An example:

2020-07-21T01:52:37+00:00 devicename=device1 | id=a522131 | date=2020-07-21T01:51:20 | name=peter | score=5 | action=read | randomfield1=nothingimportant | score=2 | action=read | score=2 | action=write | score=2 | action=write | randomfield2=nothingimportant

The intended resulting table where "actions" is a mv field, listing all actions (merging "score" and "action" as well), each on a line, but within the single field (actions):

name=peter
actions=
5:read
2:read
2:write
2:write

Labels (2)
Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

See if this helps.

| makeresults | eval _raw="2020-07-21T01:52:37+00:00 devicename=device1 | id=a522131 | date=2020-07-21T01:51:20 | name=peter | score=5 | action=read | randomfield1=nothingimportant | score=2 | action=read | score=2 | action=write | score=2 | action=write | randomfield2=nothingimportant"
```Above just creates test data```
| rex "\bname=(?<name>\w+)" 
| rex max_match=0 "score=(?<score>\d+)" 
| rex max_match=0 "action=(?<action>\w+)"
| eval actions=mvzip(score, action, ":")
| table name actions
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...