topic Re: How do you parse multiple columns (key/value)? in Splunk Search

How do you parse multiple columns (key/value)?

braicu — Fri, 08 Mar 2019 15:36:00 GMT

Hello,

Please help me with this.

I have result of two columns:

Tag-Key                                Tag-Value
Account                                   CIP
ApplicationName                   Infrastructure
AssetDataStored               InternalUseOnly
CostCenter                            Landing Zone
Environment                           LandingZoneStackSet
Name                                      Production
Owner                                     S3 LZ Access Logs

My question is, how do I parse them into individual columns like filter by Key:

Account                   ApplicationName          CostCenter          
CIP                            Infrastructure                Landing Zone
Sandbox                  Production                     CIP
etc                                                                     etc

Re: How do you parse multiple columns (key/value)?

nickhills — Fri, 08 Mar 2019 16:04:50 GMT

Edited my post:

I was suggesting transpose, but on testing I'm not sure it will work for you.

Here is the documentation though: https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Transpose

Re: How do you parse multiple columns (key/value)?

Anam — Fri, 08 Mar 2019 17:22:47 GMT

Hi braicu

Thank you for posting your question on the Splunk Answers community. Are you getting these results from a search? If possible can you include your search in your post so members of the community can help provide further guidance.

Thanks

Re: How do you parse multiple columns (key/value)?

vnravikumar — Fri, 08 Mar 2019 17:54:39 GMT

Hi @braicu

Try this

your query.. | sort Tag_Key,Tag_Value | table Tag_Key,Tag_Value | transpose 0  header_field=Tag_Key |fields - column

Re: How do you parse multiple columns (key/value)?

nickhills — Fri, 08 Mar 2019 17:57:04 GMT

Ha! That was exactly my suggestion, but I tried testing it with makeresults and it didn’t work very well.

Maybe it will work with real data!?

Re: How do you parse multiple columns (key/value)?

vnravikumar — Fri, 08 Mar 2019 18:00:20 GMT

It is working

Re: How do you parse multiple columns (key/value)?

braicu — Tue, 29 Sep 2020 23:39:58 GMT

i tested and is not working good 😞 .,,Not working guys 😞 . I have other fields not only Tag-Key & Tag Value . I need to split that Tag-Key to be the column name , and Value to be the value for the columns ( and i have multiple values not only one) , but the other columns that i have ( region , aws_account_id etc ) to remain unchanged , and transpose is not good solution.

Re: How do you parse multiple columns (key/value)?

braicu — Sat, 09 Mar 2019 10:59:32 GMT

I have tested and is not working 😞 . I have other columns not only those 2 and i need the other columns to remain unchanged. I need only tag-key to be parsed as column name , and tag-name to be the value for the columns.