foreach for mv fields?

Question

I've got a search which uses a transaction command to combine a few log events together. As a result, I have a field which is multi-value. For chart display purposes, I'd like to truncate the values to a certain width. For a single-value column, I'd do something like eval if(length(field) > 30, substr(field, 1, 27) + "...", field). This doesn't work for a multi-value field. The "mvcount" of the multi-value field is not fixed, so iterating through each one by one isn't easily possible.

Any hints?

Accepted Answer

2

while we currently do not supply a foreach command in eval you can try to truncate the field values before the transaction command (ie before the field becomes multivalued). For example:

... | eval field=if(length(field) > 30, substr(field, 1, 27) + "...", field) | transaction .... | chart ....

link

answered 22 May '10, 00:43

Ledion Bitincka ♦
1.5k●3●6
accept rate: 35%

Didn't think of putting the truncation first. Nice!

(22 May '10, 01:48) smisplunk

Answer 2

Hmm. I dont think eval can do this, but i could be wrong.

As a workaround, or arguably a simpler way to do the same thing, you can create a copy of the field before the transaction command, truncate those copies when they're out there, before they get packaged into transactions. Then keep the transaction logic the way it is now, but in the final display, use the truncated field, which will have been carried along for the ride.

foreach for mv fields?

Follow this question

Splunk Resources

Related questions