topic Re: Repeat index and host time in tablerow in Splunk Search

Repeat index and host time in tablerow

karunagaraprabh — Wed, 24 Jun 2020 03:16:56 GMT

Hi, i need index time and host time to repeat for each data for host, printedA_epoch & printedb_epoch, how can i achieve it

Thanks,

Karuna

Re: Repeat index and host time in tablerow

bowesmana — Wed, 24 Jun 2020 04:56:24 GMT

If you have Splunk 8 (for mvmap) you can do this

Hope this helps

Re: Repeat index and host time in tablerow

karunagaraprabh — Wed, 24 Jun 2020 06:14:33 GMT

Thank you @bowesmana but am using splunk 7.0.1 where 'mvmap' function is not supported or undefined, could you please provide me an alternative command.

Re: Repeat index and host time in tablerow

bowesmana — Wed, 24 Jun 2020 06:09:28 GMT

Try this

Re: Repeat index and host time in tablerow

karunagaraprabh — Wed, 24 Jun 2020 06:32:10 GMT

Thanks for your valuable time

| stats list(*) as * it displays all my field in the indexed data i have to display only limited columns

CustomerjobId,printedA_epoch,printedB_epoch,indexdatetime

as i have to do difference of A and B epoc with indexedtime epoc

Re: Repeat index and host time in tablerow

bowesmana — Wed, 24 Jun 2020 06:33:36 GMT

Replace the list(*) as * with

list(a) as a list(b) as b list(c) as c

for the columns you need

Re: Repeat index and host time in tablerow

karunagaraprabh — Wed, 24 Jun 2020 09:03:37 GMT

Hi @bowesmana , really appreciate your multiple solution, after implementing am getting Aepoch vales as 0000 instead of its value..

Thanks,

Karuna