Splunk Search

how to convert a single field into multivalued field

Tridi123
New Member

My currrent ouput is now:

file name                                       keyword 
project_plan_project.doc                        project 
project_plan_project.doc                        plan

Actually i want single row at final ouput as below:

file_name                                        keyword
project_plan_project.doc                         project
                                                 plan

can nomv help on this requirement??

Tags (1)
0 Karma

lguinn2
Legend

Actually, I think that stats might work...

yoursearchhere
| stats values(keyword) by file_name

if you just need to see the values. If you want a count for each value found, then you could do

yoursearchhere
| stats count by file_name keyword
0 Karma

lguinn2
Legend

I updated my answer to include a way to count...

0 Karma

Tridi123
New Member

can i use
............|stats values(keyword) count(keyword) as keywordshit
by file name

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...