makemv

Description

Converts a single valued field into a multivalue field by splitting it on a simple string delimiter, which can be a multicharacter. Alternatively, splits field by using a regex.

Syntax

makemv [delim=<string> | tokenizer=<string>] [allowempty=<bool>] [setsv=<bool>] <field>

Required arguments

field

Syntax: <field>

Description: Specify the name of a field.

Optional arguments

delim

Syntax: delim=<string>

Description: A string value used as a delimiter. Splits the values in field on every occurrence of this string.

Default: A single space (" ").

tokenizer

Syntax: tokenizer=<string>

Description: A regex, with a capturing group, that is repeat-matched against the text of field. For each match, the first capturing group is used as a value of the newly created multivalue field.

allowempty

Syntax: allowempty=<bool>

Description: Specifies whether to permit empty string values in the multivalue field. When using delim=true, repeats of the delimiter string produce empty string values in the multivalue field. For example if delim="," and field="a,,b", by default does not produce any value for the empty string. When using the tokenizer argument, zero length matches produce empty string values. By default they produce no values.

Default: false

setsv

Syntax: setsv=<bool>

Description: If true, the makemv command combines the decided values of the field into a single value, which is set on the same field. (The simultaneous existence of a multivalue and a single value for the same field is a problematic aspect of this flag.)

Default: false

Usage

There evaluation functions and statistical functions that you can use on multivalue fields or to return multivalue fields.

Examples

Example 1:

For sendmail search results, separate the values of "senders" into multiple values. Display the top values.

eventtype="sendmail" | makemv delim="," senders | top senders

Example 2:

Separate the value of "foo" into multiple values.

... | makemv delim=":" allowempty=true foo

See also

Commands:
mvcombine
mvexpand
nomv

Functions:
Multivalue eval functions
Multivalue stats and chart functions
split

Answers

Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the makemv command.