Splunk Search

How to extract multiple values from a multi-value field and use these in a table?

mal81394
New Member

I have a multivalue field (custom_4) separated by dollar signs that I have separated in to separate values with the below search. However, that only separate each value to a different line on the same row. I would like to create column headers for each new value and put each new value under a column header. Basically, when I split the multi value field using makemv I want the new single values to appear across the row for the same record with separate column names instead of just multiple rows as it is now. The new column headers (fields) would be: Tool, ID, Severity,Incident Id, Progress. Thanks!

index=UIM sourcetype=nas_transaction_log 
| makemv delim="$" custom_4
| top limit=20 custom_4

Before:

"Tool name"
"ID#"
"Severity"
"incident id#"
"status"

What I want:

Tool                            ID                  Severity                 Incident ID             Progress
"Tool name"           "ID#"               "severity"              "incident#"             "status"
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Here's one (untested) way. There may be others.

index=UIM sourcetype=nas_transaction_log 
| makemv delim="$" custom_4
| eval Tool=mvindex(custom_4,0), ID=mvindex(custom_4, 1), Severity=mvindex(custom_4, 2), 'Incident ID'=mvindex(custom_4, 3), Progress=mvindex(custom_4, 4)
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Here's one (untested) way. There may be others.

index=UIM sourcetype=nas_transaction_log 
| makemv delim="$" custom_4
| eval Tool=mvindex(custom_4,0), ID=mvindex(custom_4, 1), Severity=mvindex(custom_4, 2), 'Incident ID'=mvindex(custom_4, 3), Progress=mvindex(custom_4, 4)
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...