Indeed lookups often end up with multivalue. You need to make sure that every field to include have equal number of values. Usually I am in favor of JSON like in @livehybrid 's suggestion, although it should not be that complex; especially, one should not compose JSON with string. More on JSON later. There is an even simpler approach if you can enumerate fields to include: multikv. No mvexpand needed. Here is how: | eval _raw = mvappend("FunctionGroup,MsgNr,alarm_severity,area,equipment",
mvzip(mvzip(mvzip(mvzip(FunctionGroup,MsgNr, ","), alarm_severity, ","), area), equipment, ",")
)
| multikv forceheader=1
| fields - _raw linecount The idea is to compose a CSV table with mvzip, then extract from this table. If composing nested mvzip is too much, or if you cannot easily enumerate fields to include, you can add foreach to your arsenal: | rename FunctionGroup as _raw
| eval header = "FunctionGroup"
| foreach MsgNr,alarm_severity,area,equipment
[ eval _raw = mvzip(_raw, <<FIELD>>, ","), header = header . "," . "<<FIELD>>"]
| eval _raw = mvappend(header, _raw)
| multikv forceheader=1
| fields - _raw header linecount Now, back to JSON - in this use case, it is more involved than multikv. Again, with help of foreach and provided that your Splunk version is 8.1 or later, this is a semantic way to do it: | eval jcombo = json_object()
| eval idx = mvrange(0, mvcount(FunctionGroup))
| foreach FunctionGroup MsgNr alarm_severity area equipment
[ eval jcombo = json_set(jcombo, "<<FIELD>>", mvindex(<<FIELD>>, idx))]
| fields - FunctionGroup MsgNr alarm_severity area equipment
| mvexpand jcombo
| fields - idx jcombo Of course, you can also do this without foreach.
... View more
