How do I split multiple events into seperate columns, and form one single row?

CodyQuinney — Tue, 29 Sep 2020 16:54:51 GMT

Hi,

I'm wanting to split multiple event types into separate columns, and form one single row for a Linux system. Currently, my output looks similar to:
_time acct Type Result
12:49 smith User_Start Success
13:05 smith User_End Success

I would like to have it look more like this (if possible):
_time acct Type _time Type Result
12:49 smith User_Start 13:05 User_End Success

Re: How do I split multiple events into seperate columns, and form one single row?

kamlesh_vaghela — Tue, 21 Nov 2017 17:25:06 GMT

Can you please try this?

YOUR SEARCH  | stats delim="," list(Type) as Type list(_time) as Time list(Result) as Result by acct | mvcombine Time | mvcombine Type | mvcombine Result | eval Type1=mvindex(split(Type,","),0),Type2=mvindex(split(Type,","),1),Start_Time=strftime(mvindex(split(Time,","),0),"%Y-%m-%d %H:%M:%S"),End_Time=strftime(mvindex(split(Time,","),1),"%Y-%m-%d %H:%M:%S") ,Result1=mvindex(split(Result,","),0),Result2=mvindex(split(Result,","),1)  | table acct Type1 Start_Time Result1 Type2 End_Time Result2

Thanks

topic How do I split multiple events into seperate columns, and form one single row? in Deployment Architecture

How do I split multiple events into seperate columns, and form one single row?

Re: How do I split multiple events into seperate columns, and form one single row?