topic Re: split transactions in exported excel in Splunk Search

split transactions in exported excel

user93 — Wed, 20 May 2020 12:58:53 GMT

Hello,

I have a list of strings that are more meaningful when grouped and viewed together by time. This is great and easy to do in Splunk with the transaction command. However, I need to export this to excel. In the export, the transaction becomes a single line and I want to mimic the format to make the groups easy to read.

I get this is probably more of an excel question, but maybe there is some Splunk pre-formatting I can do to make it easier like separate the individual items in a transaction by commas, or something similar.

Example of transaction output:

I need help | categoryA | _time
help

help me please

what is splunk | category b | _time
splunk
help please splunk

Example of excel extract

I need help help help me please | cat a | _time
what is splunk splunk help please splunk | cat b | time

I want to wrap the values in the excel cell, but I have nothing to note when to wrap and I don't actually know how to wrap a cell.

Re: split transactions in exported excel

to4kawa — Sat, 23 May 2020 23:48:34 GMT

| makeresults
| eval msg=split("I need help,help,help me please",","), category="category_A"
| appendpipe [ eval msg=split("what is splunk,splunk,help please splunk",","), category="category_B"]
| rename COMMENT as "this is sample you provide"
| rename COMMENT as "please check the result. from here, the logic"
| eval msg=mvjoin(msg,",")
| fields msg,category,_time
| table msg,category,_time

Outputing the CSV, please use fields and table for delete extra fields.

Re: split transactions in exported excel

user93 — Tue, 26 May 2020 20:21:54 GMT

@to4kawa

Hey! Thank you, but this doesn't really fit my needs. I think I confused you with my example.

I need any combination of strings, which are actually separate events now grouped in the transaction, to have a comma after the event to give me a way to wrap them line by line in Excel

The category, I want nothing to do with that, they are just another field value that is important to show in the end report