topic Re: how to show a table in if in Splunk Search

how to show a table in if

Mohsin123 — Mon, 25 Sep 2017 09:39:12 GMT

My question is :
i have output in this format :
a _time
b _time
a _time
b _time

i want all these outputs alone with a coloumn that gives the _time (as start time) for only b type rows

Re: how to show a table in if

gcusello — Mon, 25 Sep 2017 09:53:01 GMT

Hi shraddhamuduli,
I don't know the fields you extracted, anyway, if "a" column name is "fieldA", try something like this:

your_search fieldA="b"
| table _time

Bye.
Giuseppe

Re: how to show a table in if

inventsekar — Mon, 25 Sep 2017 10:29:55 GMT

current output -
a _time
b _time
a _time
b _time

if you want the output be like -
b _time
b _time

 your_search fieldB="b"
 | table fieldB _time

or, please update us your current query which gives the output as you shown on the question.. then we can edit that query..

Re: how to show a table in if

Mohsin123 — Tue, 29 Sep 2020 15:51:57 GMT

its like this :

Starting Acquisition Sources Database source '20170924'SourceQuery_0 for DataSource 'Transaction' and Domain(s) TMS

Commit of Processing State started for Domain 'TMS' and OrgUnit '-FR'
Starting Acquisition Sources Database source '20170924'SourceQuery_0 for DataSource 'Transaction' and Domain(s) TMS
Commit of Processing State started for Domain 'TMS' and OrgUnit '-MM'

these are 4 rows ...
my job is clubbed like this, first is the database acquisition(this is the start time) , next is the commit of processing state started . Ex; For job FR , my job start time is the time for database acquisition . and then the job starts at commit of processing time..but my actual time the job FR started in system is the one for database aqcuisition .....

Re: how to show a table in if

Mohsin123 — Tue, 29 Sep 2020 15:51:59 GMT

its like this :