Manipulate and evaluate fields with multiple values
Splunk parses multivalue fields at search time, and allows you to process the values in the search pipeline. Search commands that work with multivalue fields include makemv, mvcombine, mvexpand, and nomv. The eval and where commands support functions, such as
mvcount(), mvfilter(), mvindex(), and mvjoin() that you can use with multi-valued fields. For more information on these functions see the Functions for eval and where in the Search Reference manual and the examples on this page.
You can configure multi-value fields in fields.conf to enable Splunk software to recognize multiple values in an extracted field value. Edit fields.conf in
$SPLUNK_HOME/etc/system/local/, or your own custom application directory in
$SPLUNK_HOME/etc/apps/. For more information on how to do this, see "Configure multivalue fields" in the Knowledge Manager manual. If you have Splunk Cloud and want to define multivalue fields, you must file a Support ticket, because you do not have access to fields.conf.
Manipulate multivalued fields
Use nomv to convert a multivalue field into a single value
You can use the nomv command to convert values of the specified multivalued field into one single value. The nomv command overrides multivalue field configurations set in fields.conf.
In this example for sendmail events, you want to combine the values of the senders field into a single value.
eventtype="sendmail" | nomv senders
Use makemv to separate a multivalue field
You can use the makemv command to separate multivalue fields into multiple single value fields. In this example for sendmail search results, you want to separate the values of the "senders" field into multiple field values.
eventtype="sendmail" | makemv delim="," senders
After you separate the field values, you can pipe it through other commands. For example, you can display the top senders.
eventtype="sendmail" | makemv delim="," senders | top senders
Use mvexpand to create multiple events based on a multivalue field
You can use the mvexpand command to expand the values of a multivalue field into separate events for each value of the multivalue field. In this example, Splunk creates new events for each value of multivalue field, "foo".
... | mvexpand foo
Use mvcombine to create a multivalue field from similar events
Combine the values of "foo" with ":" delimiter.
... | mvcombine delim=":" foo
Evaluate multivalued fields
One of the more common examples of multivalue fields is that of email address fields, which typically appears two to three times in a single sendmail event--once for the sender, another time for the list of recipients, and possibly a third time for the list of Cc addresses, if one exists.
Count the number of values in a field
mvcount() function to count the number of values in a single-valued or multivalued field.
In this example, mvcount() returns the number of email addresses in the To, From, and Cc fields and saves them in the specified "_count" fields.
eventtype="sendmail" | eval To_count=mvcount(to) | eval From_count=mvcount(from) | eval Cc_count=mvcount(cc)
Note: If only a single email address to exists in the sender field (as you would expect), mvcount(from) returns 1. Also, if there is no Cc address included, the Cc field might not exist for the event and mvcount(cc) returns NULL.
Filter values from a multivalued field
mvfilter() function to filter a multivalued field using an arbitrary Boolean expression.
In this example, mvfilter() keeps all values of the field
eventtype="sendmail" | eval email=mvfilter(match(email, "\.net$") OR match(email, "\.org$"))
Important: This function works with ONLY ONE field at a time.
Note: This example also uses the
match() function to compare the pattern defined in quotes to the value of
Return a subset of values from a multivalued field
mvindex() function to reference a specific value or a subset of values in a multivalued field. Since the index numbering starts at 0, if you want to reference the 3rd value of a field, you would specify it as 2.
In this example, mvindex() returns the first email address in the "To" field for every email sent by Sender:
eventtype="sendmail" from=Sender@* | eval to_first=mvindex(to,0)
If you wanted to see the top 3 email addresses that Sender writes to each time:
eventtype="sendmail" from=Sender@* | eval top_three=mvindex(to,0,2)
Note: In this case,
top_three is, itself, a multivalued field.
Extract fields with search commands
About calculating statistics
This documentation applies to the following versions of Splunk® Enterprise: 5.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.0.14, 5.0.15, 5.0.16, 5.0.17, 5.0.18, 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14