Splunk Search

create a multivalue field, based on multiple single value fields with the same field name

fsiemons
Engager

Hi there, I have a bit of a tough one.

I have a log with multiple entries of the same field, basically a list of values. I am trying to merge these values into a single new field, with a line for every value that was in the RAW event.

An example:

2020-07-21T01:52:37+00:00 devicename=device1 | id=a522131 | date=2020-07-21T01:51:20 | name=peter | score=5 | action=read | randomfield1=nothingimportant | score=2 | action=read | score=2 | action=write | score=2 | action=write | randomfield2=nothingimportant

The intended resulting table where "actions" is a mv field, listing all actions (merging "score" and "action" as well), each on a line, but within the single field (actions):

name=peter
actions=
5:read
2:read
2:write
2:write

Labels (2)
Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

See if this helps.

| makeresults | eval _raw="2020-07-21T01:52:37+00:00 devicename=device1 | id=a522131 | date=2020-07-21T01:51:20 | name=peter | score=5 | action=read | randomfield1=nothingimportant | score=2 | action=read | score=2 | action=write | score=2 | action=write | randomfield2=nothingimportant"
```Above just creates test data```
| rex "\bname=(?<name>\w+)" 
| rex max_match=0 "score=(?<score>\d+)" 
| rex max_match=0 "action=(?<action>\w+)"
| eval actions=mvzip(score, action, ":")
| table name actions
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...