topic Re: how to extract a value from a field name ? in Splunk Search

how to extract a value from a field name ?

mah — Tue, 04 May 2021 12:27:57 GMT

Hi,

I have a table like that :

test	total	productA_xxxx	productA_zzzz	productB_xxxx	productB_zzzz
1	22	0.23	0.36	0.44	0.55

What I want is a table like that :

test	total	object	xxxx	zzzz
1	22	productA	0.23	0.36
1	22	productB	0.44	0.55

How can I extract "product" from the name of the field ?

Can you help me please ?

Thank you !

Re: how to extract a value from a field name ?

ITWhisperer — Tue, 04 May 2021 12:02:14 GMT

Re: how to extract a value from a field name ?

mah — Tue, 04 May 2021 12:29:38 GMT

Hi @ITWhisperer

I edited my post because it does not suit with my whole table.

Please look at my first post I have just edited.

Thanks a lot!

Re: how to extract a value from a field name ?

ITWhisperer — Tue, 04 May 2021 14:03:36 GMT

It nearly always helps to have a fuller picture! 😀

First, combine the common fields, then untable (this is the inverse of xyseries). Now split the product into object and product. Append the object to the common field, and put back into an xyseries. Finally, split out the components of the common field.

Re: how to extract a value from a field name ?

mah — Tue, 04 May 2021 14:24:33 GMT

Hi @ITWhisperer

It is exactly what I needed !

Thanks a lot !