Splunk Search

how do i combine multiple fields in to a single field??

rakesh_498115
Motivator

hi..

I have four fields say A,B,C,D..All these are multivalued fields .. i.e for a single event they can be multiple values in these fields..how can i join them in to a single field ??

used eval MyFiled=(A+B+C+D) like this .. but this is not working...can any one pls help

Tags (2)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@rakesh_498115

Try this:

| makeresults 
| eval A="A,B,C",B="D,E,F",C="G,H,I",D="X,Y,Z",E=nulll 
| foreach * 
    [ eval "<<FIELD>>"=split(<<FIELD>>,",") ] 
| eval multivalued_field=mvappend(A,B,C,D),singlevalued_field=mvjoin(multivalued_field,",")
0 Karma

wpreston
Motivator

My suggestion would be to use mvappend and mvjoin to create the fields you need. Perhaps something like this?

...your search | fillnull value="N/A" A 
               | eval TempField=mvappend(B, " ", C) 
               | eval TempField=mvappend(TempField, " ", D) 
               | eval TempField=mvappend(A, " ", TempField)
               | eval FinalField=mvjoin(TempField, " ")
               | ...rest of your commands

Then use whatever you set for FinalField in your reports, and just ignore TempField. It's a bit roundabout, but I think it will do the trick.

Note: I can't post comments to answers from my workplace for some reason, so I'll have to respond to any by editing the original post.

okrabbe_splunk
Splunk Employee
Splunk Employee

If you are trying to join multi value fields together you should look into using mvzip. You would have to call it multiple times because mvzip only works on two fields at a time.

The description of eval functions is located here:

http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/CommonEvalFunctions

0 Karma

okrabbe_splunk
Splunk Employee
Splunk Employee

Rakesh, could you share maybe a sample of your data and the search string you are using now?

0 Karma

rakesh_498115
Motivator

Hi Linu1988..i tried that.but it didnt wrk 😞

0 Karma

okrabbe_splunk
Splunk Employee
Splunk Employee

Linu1988 has the right idea. Try that and let us know how it works.

0 Karma

linu1988
Champion

Could you try table A,B then mvexpand B? Then try with mvzip.

rakesh_498115
Motivator

[cont..]

and it is missing all the other values of B i.e 2,3 and 4. Can you please tell a way in which i can fillnull all the values of A to be "N/A" . if there is no data to extract for A. thanks

0 Karma

srinathd
Contributor

Hi Rakesh, Did you get the answer for this. I am facing the same issue. please let me know. Thanks

0 Karma

rakesh_498115
Motivator

small issue here..say i am getting one event. and in that single event i dnt have values for A and have mutliple values for B. in this case i used fillnull to fill the value of "A" as "NA". Since i am getting one event as ouput. A is having only one value "N/A" where as B field having multiple fields... so in this case when i use mvzip(A,B) ..its is only showing me one value .

say for single event output . B has values 1 ,2 , 3, 4 as multiple values.. A has no data to extract ..so used to fillnull to fill A as "N/A" .. now A is having the value ="N/A"

now mvzip(A,B) is resulting as N/A,1

0 Karma

rakesh_498115
Motivator

yeah..thanks orkrabbe_splunk even i found this..but since mvzip has only two fields..i thought ther could be something else to figure this..:)

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...