Splunk Search

isuue with inputlookup file to expand multi values

james_n
Path Finder

Hi Experts,

I have a inputlookup file which consists of two fields i,e _time and names fields as shown below,

_time names
02/02/2020 user1
user2
08/02/2020 user1
user2
user3
10/02/2020 user2

I want to expand multi value filed i.e, names filed and show unique users list based on time, i tried |inputlookup filename.csv |stats values(names) as name |mvexpand name |dedup name |table name| sort - name but not worked for me,.
Please help on this, Thanks in advance.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@james_n

Are you looking for this?

| inputlookup filename.csv | rex mode=sed "s/(\n)/,/g" field=names | eval names=split(names,",") | stats values(names) as name by _time
0 Karma
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...