Create key value pair from a key and value column

Cuyose — Tue, 28 Jan 2020 21:15:31 GMT

I am not sure why I can't figure this out, been all over and each untable or makemv solution fails for this simple challenge.

I have a lookup with 3 fields
id, key, value

this will produce rows that look like the following with these headers
ID, KEY, VALUE
1, installDate, 10/15/2010
1,closeDate, 07/21,2003
1,deployed,yes
2,date1, .... etc.

I want to be able to do select ids where deployed=yes InstallDate=*

I can't for the life of me figure this out

Re: Create key value pair from a key and value column

somesoni2 — Tue, 28 Jan 2020 21:58:04 GMT

Give this a try

| inputlookup yourlookup.csv | fields ID KEY VALUE
| eval {KEY}=VALUE | field - KEY VALUE
| stats values(*) as * by ID
| where deployed="yes" AND installDate="<whatever>"

topic Re: Create key value pair from a key and value column in Splunk Search

Create key value pair from a key and value column

Re: Create key value pair from a key and value column