Good day, As mentioned, I wanted to flatten a series of multivalue fields, and make it just like single row entries, where the type will become "String" and not "Multivalue". To be clearer, here's m...
See more...
Good day, As mentioned, I wanted to flatten a series of multivalue fields, and make it just like single row entries, where the type will become "String" and not "Multivalue". To be clearer, here's my base search: | makeresults
| eval a="this,is"
| eval b="an,example"
| eval c="group1,group2"
| makemv delim="," a
| makemv delim="," b
| makemv delim="," c
| stats values(a) as a, values(b) as b by c
| eval type_a=typeof(a)
| eval type_b=typeof(b) result of this will be: so what I wanted to do is make the result like this: c a b type_a type_b group1 is an String String group1 this example String String group2 is an String String group3 this example String String When i add this to the base search: mvexpand a
| mvexpand b
| eval type_c=typeof(a)
| eval type_d=typeof(b) the output will be: As you can see, this was able to handle the requirement in making the entries as "String". However, it has created unnecessary combinations (as compared to my expected output), given that "a" and "b" are multivalue fields. I am not sure if the way I'll state this is correct, but perhaps, what I wanted is to expand/remove the "grouping" nature, but still output/display it as a single line/row entry like in a CSV file. An option to handle this is just output the results into a CSV or JSON file, and do the processing away from Splunk, but doing everything inside Splunk is included in my requirement. Thanks a lot in advance, and as always, any ideas are greatly appreciated