I have four fields say A,B,C,D..All these are multivalued fields .. i.e for a single event they can be multiple values in these fields..how can i join them in to a single field ??
used eval MyFiled=(A+B+C+D) like this .. but this is not working...can any one pls help
| makeresults | eval A="A,B,C",B="D,E,F",C="G,H,I",D="X,Y,Z",E=nulll | foreach * [ eval "<<FIELD>>"=split(<<FIELD>>,",") ] | eval multivalued_field=mvappend(A,B,C,D),singlevalued_field=mvjoin(multivalued_field,",")
My suggestion would be to use mvappend and mvjoin to create the fields you need. Perhaps something like this?
...your search | fillnull value="N/A" A | eval TempField=mvappend(B, " ", C) | eval TempField=mvappend(TempField, " ", D) | eval TempField=mvappend(A, " ", TempField) | eval FinalField=mvjoin(TempField, " ") | ...rest of your commands
Then use whatever you set for FinalField in your reports, and just ignore TempField. It's a bit roundabout, but I think it will do the trick.
Note: I can't post comments to answers from my workplace for some reason, so I'll have to respond to any by editing the original post.
If you are trying to join multi value fields together you should look into using mvzip. You would have to call it multiple times because mvzip only works on two fields at a time.
The description of eval functions is located here:
and it is missing all the other values of B i.e 2,3 and 4. Can you please tell a way in which i can fillnull all the values of A to be "N/A" . if there is no data to extract for A. thanks
small issue here..say i am getting one event. and in that single event i dnt have values for A and have mutliple values for B. in this case i used fillnull to fill the value of "A" as "NA". Since i am getting one event as ouput. A is having only one value "N/A" where as B field having multiple fields... so in this case when i use mvzip(A,B) ..its is only showing me one value .
say for single event output . B has values 1 ,2 , 3, 4 as multiple values.. A has no data to extract ..so used to fillnull to fill A as "N/A" .. now A is having the value ="N/A"
now mvzip(A,B) is resulting as N/A,1