Splunk® Enterprise

Search Manual

Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Manipulate and evaluate fields with multiple values

Splunk parses multivalue fields at search time, and allows you to process the values in the search pipeline. Search commands that work with multivalue fields include makemv, mvcombine, mvexpand, and nomv. The eval and where commands support functions, such as mvcount(), mvfilter(), mvindex(), and mvjoin() that you can use with multi-valued fields. For more information on these functions see the Functions for eval and where in the Search Reference manual and the examples on this page.

You can configure multi-value fields in fields.conf to enable Splunk software to recognize multiple values in an extracted field value. Edit fields.conf in $SPLUNK_HOME/etc/system/local/, or your own custom application directory in $SPLUNK_HOME/etc/apps/. For more information on how to do this, see "Configure multivalue fields" in the Knowledge Manager manual. If you have Splunk Cloud and want to define multivalue fields, you must file a Support ticket, because you do not have access to fields.conf.

Manipulate multivalued fields

Use nomv to convert a multivalue field into a single value

You can use the nomv command to convert values of the specified multivalued field into one single value. The nomv command overrides multivalue field configurations set in fields.conf.

In this example for sendmail events, you want to combine the values of the senders field into a single value.

eventtype="sendmail" | nomv senders

Use makemv to separate a multivalue field

You can use the makemv command to separate multivalue fields into multiple single value fields. In this example for sendmail search results, you want to separate the values of the "senders" field into multiple field values.

eventtype="sendmail" | makemv delim="," senders

After you separate the field values, you can pipe it through other commands. For example, you can display the top senders.

eventtype="sendmail" | makemv delim="," senders | top senders

Use mvexpand to create multiple events based on a multivalue field

You can use the mvexpand command to expand the values of a multivalue field into separate events for each value of the multivalue field. In this example, Splunk creates new events for each value of multivalue field, "foo".

... | mvexpand foo

Use mvcombine to create a multivalue field from similar events

Combine the values of "foo" with ":" delimiter.

... | mvcombine delim=":" foo

Evaluate multivalued fields

One of the more common examples of multivalue fields is that of email address fields, which typically appears two to three times in a single sendmail event--once for the sender, another time for the list of recipients, and possibly a third time for the list of Cc addresses, if one exists.

Count the number of values in a field

Use the mvcount() function to count the number of values in a single-valued or multivalued field.

In this example, mvcount() returns the number of email addresses in the To, From, and Cc fields and saves them in the specified "_count" fields.

eventtype="sendmail" | eval To_count=mvcount(to) | eval From_count=mvcount(from) | eval Cc_count=mvcount(cc)

Note: If only a single email address to exists in the sender field (as you would expect), mvcount(from) returns 1. Also, if there is no Cc address included, the Cc field might not exist for the event and mvcount(cc) returns NULL.

Filter values from a multivalued field

Use the mvfilter() function to filter a multivalued field using an arbitrary Boolean expression.

In this example, mvfilter() keeps all values of the field email that end in .net or .org:

eventtype="sendmail" | eval email=mvfilter(match(email, "\.net$") OR match(email, "\.org$"))

Important: This function works with ONLY ONE field at a time.

Note: This example also uses the match() function to compare the pattern defined in quotes to the value of email. For more information, see Functions for eval and where in the Search Reference manual.

Return a subset of values from a multivalued field

Use the mvindex() function to reference a specific value or a subset of values in a multivalued field. Since the index numbering starts at 0, if you want to reference the 3rd value of a field, you would specify it as 2.

In this example, mvindex() returns the first email address in the "To" field for every email sent by Sender:

eventtype="sendmail" from=Sender@* | eval to_first=mvindex(to,0)

If you wanted to see the top 3 email addresses that Sender writes to each time:

eventtype="sendmail" from=Sender@* | eval top_three=mvindex(to,0,2)

Note: In this case, top_three is, itself, a multivalued field.

Last modified on 28 June, 2016
Extract fields with search commands
About calculating statistics

This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters