topic Re: Splunk in Splunk Search

Splunk

vinod0313 — Tue, 18 Aug 2020 07:30:13 GMT

Hello

I have a log like this:

ABC=true,DEF=false,GHI=false,JKL=true

I want to show only ABC and JKL in the result,because these are having value as true.

Result should be like below

ABC
JKL

Re: Splunk

to4kawa — Tue, 18 Aug 2020 07:40:54 GMT

index=_internal | head 1 | fields _raw
| eval _raw="ABC=true,DEF=false,GHI=false,JKL=true"
| rename COMMENT as "this is sample"

Re: Splunk

vinod0313 — Tue, 18 Aug 2020 09:37:23 GMT

That is not a static log,it is dynamic log

ABC=TRUE or FALSE depend upon Source The ABC value may differ
so if the value of ABC=TRUE then we have to show ABC in result other wise No.

Re: Splunk

rnowitzki — Tue, 18 Aug 2020 09:48:07 GMT

Hi @vinod0313 ,

@to4kawa's option is dynamic like that. You only need the part starting with | kv
The lines above were just to make up some sample data.

You can change ABC to ACB or ACAB or whatever your data will have - only the ones with "true" as value will be listed. Give it a try 🙂

BR
Ralph