Related Answers
Download topic as PDF
makemv
Description
Converts a single valued field into a multivalue field by splitting the values on a simple string delimiter. The delimiter can be a multicharacter delimiter. Alternatively, splits field by using a regex.
Syntax
makemv [delim=<string> | tokenizer=<string>] [allowempty=<bool>] [setsv=<bool>] <field>
Required arguments
- field
- Syntax: <field>
- Description: Specify the name of a field.
Optional arguments
- delim
- Syntax: delim=<string>
- Description: A string value used as a delimiter. Splits the values in
fieldon every occurrence of this string. - Default: A single space (" ").
- tokenizer
- Syntax: tokenizer=<string>
- Description: A
regex, with a capturing group, that is repeat-matched against the text of field. For each match, the first capturing group is used as a value of the newly created multivalue field.
- allowempty
- Syntax: allowempty=<bool>
- Description: Specifies whether to permit empty string values in the multivalue field. When using
delim=true, repeats of the delimiter string produce empty string values in the multivalue field. For example ifdelim=","andfield="a,,b", by default does not produce any value for the empty string. When using thetokenizerargument, zero length matches produce empty string values. By default they produce no values. - Default: false
- setsv
- Syntax: setsv=<bool>
- Description: If true, the
makemvcommand combines the decided values of the field into a single value, which is set on the same field. (The simultaneous existence of a multivalue and a single value for the same field is a problematic aspect of this flag.) - Default: false
Usage
The makemv command is a distributable streaming command. See Command types.
You can use evaluation functions and statistical functions on multivalue fields or to return multivalue fields.
Examples
1. Use a comma to separate field values
For sendmail search results, separate the values of "senders" into multiple values. Display the top values.
eventtype="sendmail" | makemv delim="," senders | top senders
2. Use a colon delimiter and allow empty values
Separate the value of "foo" into multiple values.
... | makemv delim=":" allowempty=true foo
3. Use a regular expression to separate values
The following search creates a result and adds three values to the my_multival field. The makemv command is used to arrange the values into separate lines.
| makeresults
| eval my_multival="one,two,three"
| makemv tokenizer="([^,]+),?" my_multival
See also
Commands:
mvcombine
mvexpand
nomv
Functions:
Multivalue eval functions
Multivalue stats and chart functions
split
Answers
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the makemv command.
|
PREVIOUS makecontinuous |
NEXT makeresults |
This documentation applies to the following versions of Splunk® Enterprise: 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 8.0.0
Comments
@Lstewart, in the See Also section, split link points to
"http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/TextFunctions#split.28X.2C.22Y.22.29"
It should point to
"http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/MultivalueEvalFunctions#Description_12"
Split is a Multivalue Eval functions, and not Text Eval functions.
This is issue is there across at least a few places where Split is referred in the See Also section.
Please update it.
Anirban - Thank you for taking the time to point this out! I have fixed all of the links that link to the split function. Broken links are muy mal and very frustrating.