Splunk transaction contains how to#

The new field, “zipped” is the result of the mvzip function. This function takes two multivalue fields, X and Y, and combines them by stitching together the first value of X with the first value of field Y, then the second with the second, and so on. This helps to keep the association among the field values. The mvzip function is used to tie corresponding values in the different fields of an event together. To expand the event into three separate events, one for each item and show the exact payment for each grocery item, we will need a combination of commands and functions. The report shows the method of payment for all three grocery items but it does not specify the actual payment method used for each item. The values in the “payment” field remain the same. The values in the “groceries” field have been split within the same event based on the comma delimiter. A delimiter specifies the boundary between characters. This command is used to split the values of a field that appear like a single value into multiple values within an event based on the delimiter. Please note that in all the results, I have deliberately excluded the default field, “_time” which is a default field generated when the makeresults command is used. The values for each multivalue field are separated by the comma delimiter. We can assume that this purchase transaction is equivalent to a log event. She paid for the eggs with cash and covered the remaining items using her credit card. Within one purchase transaction, Mary bought eggs, milk and bread. In my illustrations, I employed the “makeresults” command to generate hypothetical data for my searches so that anyone can recreate them without the need to onboard data. Note that multivalue functions can be used with eval, where or fieldformat search commands. I will cover some common search commands and functions that work with multivalue fields. In this article, I have applied a simple scenario to illustrate how different multivalue commands and functions can be used individually or combined to meet different use cases. If you ignore multivalue fields in your data, you may end up with missing and inaccurate data, sometimes reporting only the first value of the multivalue field(s) in your results.

To properly evaluate and modify multivalue fields, Splunk has some multivalue search commands and functions. Multivalue fields can also result from data augmentation using lookups.

Splunk transaction contains how to#

Have you ever come across fields with multiple values in your event data in Splunk and wondered how to modify them to get the results you need? Each field in an event typically has a single value, but for events such as email logs you can often find multiple values in the “To” and “Cc” fields.