#Splunk subsearch return multiple values how to#

This function takes a multivalue field and returns a count of the values in that field. The results are placed in a new field called ipaddresses which contains the array. | eval ipaddresses=mvappend(mvappend('localhost', srcip), destip, '192.168.1.1') The outer mvappend function contains three values: the inner mvappend function, destip is a field name, and 192.168.1.1 which is a literal IP address.The inner mvappend function contains two values: localhost is a literal string value and srcip is a field name.

#Splunk subsearch return multiple values how to#

This example shows how to use nested mvappend functions. | eval ipaddresses=mvappend('localhost', srcip) Nested mvappend functions The results are placed in a new multivalue field called ipaddresses: This example shows how to append the literal value localhost to the values in the srcip field. You can use this function with the eval and where commands, in the WHERE clause of the from command, and as part of evaluation expressions with other commands.Įxamples Specifying literals and field names The values can be strings, multivalue fields, or single value fields. This function returns a single multivalue result from a list of values. See Statistical eval functions.įor information about using string and numeric fields in functions, and nesting functions, see Overview of SPL2 eval functions. You can also use the statistical eval functions, such as max, on multivalue fields.

The following list contains the functions that you can use on multivalue fields or to return multivalue fields.