topic Re: Copy a row in a table in Splunk Search

Copy a row in a table

komalg — Mon, 30 Dec 2019 16:42:42 GMT

Hi, I am trying to conditionally add records to my table with a slight modification to the data. for example
Date ID Type Duration
2019-11-22 ABC XYZ 4
2019-11-26 BCD YZX 2

So for this record I am trying to add data to my table like
Date ID Type Duration
2019-11-22 ABC XYZ 4
2019-11-23 ABC XYZ 3 -- Add new row
2019-11-24 ABC XYZ 2 -- Add new row
2019-11-25 ABC XYZ 1 -- Add new row
2019-11-26 BCD YZX 2 -- Add new row
2019-11-27 BCD YZX 1 -- Add new row

Any pointers on this?

Thanks.

Re: Copy a row in a table

mydog8it — Mon, 30 Dec 2019 18:49:03 GMT

A Splunk Table is a visualization of data returned by a search, they do not persist beyond the "viewable" use of the original search. If the table is to be refreshed with new data, a new search is used to pull fresh results for the visualization.

Perhaps you mean a lookuptable, which looks and feels like a spreadsheet and it persists beyond the presentation of the search results.

Here is the SPL for a table result if all the fields in the example are already extracted:

        index=your_index sourcetype=your_sourcetype Date=* ID=* Type=* Duration=* | table Date ID Type Duration

Here is the SPL to create or append results in a lookuptable (make sure the lookuptable name ends in .csv):

   index=your_index sourcetype=your_sourcetype Date=* ID=* Type=* Duration=* 
    | outputlookup append=true your_lookup_name.csv

If you want to view the lookuptable after it has been populated, here is the SPL:

|inputlookup your_lookup_name.csv

Re: Copy a row in a table

richgalloway — Mon, 30 Dec 2019 19:44:00 GMT

Where does this new data come from?

Re: Copy a row in a table

to4kawa — Tue, 31 Dec 2019 00:09:19 GMT

| makeresults
| eval _raw="Date,ID,Type,Duration
2019-11-22,ABC,XYZ,4
2019-11-26,BCD,YZX,2"
| multikv
| table Date,ID,Type,Duration
| rename COMMENT as "this is the sample you provide"
| rename COMMENT as "From here, the logic"
| eval Date=strptime(Date,"%F")
| eval Date_after = relative_time(Date,"+".(Duration - 1)."d")
| eval Date=mvappend(Date,Date_after)
| mvexpand Date
| rename Date as _time
| timechart span=1d values(*) as *
| rename _time as Date
| table Date,ID,Type,Duration
| filldown ID, Type
| reverse
| streamstats count as Duration by ID
| reverse
| fieldformat Date=strftime(Date,"%F")

Hi, @komalg
How about this?