topic Split one field values into multiple fields based on values in Splunk Search

Split one field values into multiple fields based on values

skodak — Fri, 10 Jul 2020 13:38:08 GMT

status

success

failure

error

I want output like

status status 1 status2

success failure error

Re: Split one field values into multiple fileds based on values

anilchaithu — Fri, 10 Jul 2020 13:01:50 GMT

@skodak

you can use eval to split the field values

eval status1=if(like(status, "%failure%"), status, NULL), status2 = if(like(status, "%error%"), status, NULL), status=if(like(status, "%success%"), status, NULL)

Hope this helps

Re: Split one field values into multiple fileds based on values

to4kawa — Sat, 11 Jul 2020 00:07:50 GMT

| makeresults | eval _raw="status success success failure failure error error" | multikv forceheader=1 | table status | rename COMMENT as "the logic" | streamstats dc(status) as session | eval session="status".session | stats list(status) as vstatus by session | eval {session} = vstatus | stats list(status*) as status*

Re: Split one field values into multiple fileds based on values

skodak — Sat, 11 Jul 2020 02:16:47 GMT

Thank you. This helped me to resolve the issue.