topic Re: Need _time on each event for a |makeresults in Splunk Search

Need _time on each event for a |makeresults

sbowser_splunk — Tue, 29 Sep 2020 17:18:32 GMT

Hello,

I need to spoof some data and am using |makeresults for 3 hosts and their port status of "UP" (and eventually "DOWN")

This gives me 3 lines for the result but _time shows only on the first result for "host1"

Question: How do I get the above search show _time for the all 3 results?

Thank you.

Re: Need _time on each event for a |makeresults

DalJeanis — Mon, 18 Dec 2017 18:32:17 GMT

answers were posted in the slack channel

Re: Need _time on each event for a |makeresults

somesoni2 — Mon, 18 Dec 2017 18:34:16 GMT

The mvexpand command doesn't work on _* fields (internal/special splunk fields). Try like this

| makeresults
| eval raw = "host1%UP%UP%UP%#host2%UP%UP%UP%#host3%UP%UP%UP%"
| makemv raw delim="#"
| mvexpand raw
| rex field=raw "(?P<host>[^\%]+)%(?P<Port1>[^\%]+)%(?P<Port2>[^\%]+)%(?P<Port3>[^\%]+)"
| table _time host Port1 Port2 Port3

Re: Need _time on each event for a |makeresults

DalJeanis — Mon, 18 Dec 2017 18:38:19 GMT

okay, to give you three events, each with the _time, host, and one of the ports, you can do either of these

| eval myports=mvappend("Port1=".Port1."Port2=".Port2."Port3=".Port3) 
| table _time host myports 
| mvexpand myports 
| rex field=myports "(?<myport>[^=]+)=(?<myvalue>.*)$) 
| eval {myport} = myvalue 
| fields - myports myport myvalue

This first one gives you a record that looks like | table _time host Port* where Port* is either Port1, Port2 or Port3.

| streamstats count as recno  
| rename _time as time 
| untable recno portname portvalue 
| eventstats min(eval(if(portname="time",portvalue)) as _time min(eval(if(portname="host",portvalue)) as host by recno 
| where portname!="time" AND portname!="host"

This second one gives a record that looks like

| table _time host portname portvalue

Re: Need _time on each event for a |makeresults

sbowser_splunk — Mon, 18 Dec 2017 19:08:17 GMT

Thank you for all of these tips!