Splunk Search

How to split results which are combined in a table and export to a csv?

theouhuios
Motivator

Hello

I have few results which look like below in a table command. They are the values which are extracted from the xml data (using rex and mv_add) which has multiple matches in a single event.

    name   number id        emplid
 1  
    aaa    123  897hjhuih   908908 
    bbb    234  hkhkjh      8nknkjn

2
    ahkjhkj      12453  897hj545huih    9089fgfg08 
    bbjdkljsb    23544  hkhk5454jh      8nknkjn54353

I want to split them to separate rows in table so that it considers the results separate while exporting to a csv.

  name        number  id             emplid
1 aaa         123     897hjhuih      908908
2 bbb         234     hkhkjh         8nknkjn
3 ahkjhkj     12453   897hj545huih   9089fgfg08
4 bbjdkljsb   23544   hkhk5454jh     8nknkjn54353

I tried mvexpand and xmlkv but they dont work. Any idea on how to achieve this? How did you approach it when you faced this issue

Tags (2)
1 Solution

theouhuios
Motivator

Got it to work. Used this http://answers.splunk.com/answers/123887/how-to-expand-multiple-multivalue-fields as an idea on how to solve this issue. Works beautifully.

View solution in original post

theouhuios
Motivator

Got it to work. Used this http://answers.splunk.com/answers/123887/how-to-expand-multiple-multivalue-fields as an idea on how to solve this issue. Works beautifully.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...