Pivot/UnPivot Data from json msg

MrJohn230 — Thu, 19 Oct 2023 20:18:32 GMT

Hello, I'm working in splunk enterprise 8.2.4

I have the below search

index=Red msg="*COMPLETED Task*” | spath output=logMessage path=msg | rex field=logMessage "Message\|[^\t\{]*(?<json>{[^\t]+})" | eval PP_elapsedTime=spath(json, “PPInfo.PP.elapsedTime") | eval CC_elapsedTime=spath(json, “CCInfo.CC.elapsedTime") | eval System = “Member” | table System, PP_elapsedTime, CC_elapsedTime

Current output:

System	_time	PP_elapsed_Time	CC_elapsed_Time
Member	2023-09-10	1.52	4
Member	2023-09-11	2	2.6

I want the output to read:

System	_time	Reason	Value
Member	2023-09-10	PP_elapsed_Time	1.52
Member	2023-09-10	CC_elapsed_Time	4
Member	2023-09-11	PP_elapsed_Time	2
Member	2023-09-11	CC_elapsed_Time	2.6

I'm not sure where to go from here, any feedback would be appreciated.

Re: Pivot/UnPivot Data from json msg

fredclown — Thu, 19 Oct 2023 20:40:29 GMT

This should work.

topic Pivot/UnPivot Data from json msg in Splunk Dev

Pivot/UnPivot Data from json msg

Re: Pivot/UnPivot Data from json msg