Splunk Search

foreach for mv fields?

smisplunk
Path Finder

I've got a search which uses a transaction command to combine a few log events together. As a result, I have a field which is multi-value. For chart display purposes, I'd like to truncate the values to a certain width. For a single-value column, I'd do something like eval if(length(field) > 30, substr(field, 1, 27) + "...", field). This doesn't work for a multi-value field. The "mvcount" of the multi-value field is not fixed, so iterating through each one by one isn't easily possible.

Any hints?

1 Solution

Ledion_Bitincka
Splunk Employee
Splunk Employee

while we currently do not supply a foreach command in eval you can try to truncate the field values before the transaction command (ie before the field becomes multivalued). For example:

... | eval field=if(length(field) > 30, substr(field, 1, 27) + "...", field) | transaction .... | chart .... 

View solution in original post

uuppuluri_splun
Splunk Employee
Splunk Employee

FWIW, the foreach command is now available as at http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Foreach

mschaaf_twc
Engager

The foreach command is for multiple fields and not for the items within a single multivalued field, which is what is desired here.

0 Karma

sideview
SplunkTrust
SplunkTrust

Hmm. I dont think eval can do this, but i could be wrong.

As a workaround, or arguably a simpler way to do the same thing, you can create a copy of the field before the transaction command, truncate those copies when they're out there, before they get packaged into transactions. Then keep the transaction logic the way it is now, but in the final display, use the truncated field, which will have been carried along for the ride.

Ledion_Bitincka
Splunk Employee
Splunk Employee

while we currently do not supply a foreach command in eval you can try to truncate the field values before the transaction command (ie before the field becomes multivalued). For example:

... | eval field=if(length(field) > 30, substr(field, 1, 27) + "...", field) | transaction .... | chart .... 

smisplunk
Path Finder

Didn't think of putting the truncation first. Nice!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...