Splunk Search

isuue with inputlookup file to expand multi values

james_n
Path Finder

Hi Experts,

I have a inputlookup file which consists of two fields i,e _time and names fields as shown below,

_time names
02/02/2020 user1
user2
08/02/2020 user1
user2
user3
10/02/2020 user2

I want to expand multi value filed i.e, names filed and show unique users list based on time, i tried |inputlookup filename.csv |stats values(names) as name |mvexpand name |dedup name |table name| sort - name but not worked for me,.
Please help on this, Thanks in advance.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@james_n

Are you looking for this?

| inputlookup filename.csv | rex mode=sed "s/(\n)/,/g" field=names | eval names=split(names,",") | stats values(names) as name by _time
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...