topic Create a table with different fields depending if their values match a condition in Splunk Search

Create a table with different fields depending if their values match a condition

andres — Thu, 20 Jan 2022 16:00:46 GMT

I have a raw where each event looks like this (simplified for this exampel):
{"time": "2022-01-20 16:40:02.325216", "name": "name1", "deployment": "found", "secret": "correct"}

If "deployment": "not_found", I would like to have a table like:

time	name	deployment
2022-01-20 16:40:02.325216	name1	not_found

If "secret": "incorrect", I would like to have a table like:

time	name	secret
2022-01-20 16:40:02.325216	name1	incorrect

Currently, my search looks like this:

index=index host=host source=source ("not_found" OR "incorrect") | table time name deployment secret

But this means that both fields (deployment and secret) will be shown no matter what their value is.

@Ayn Is there a way to have a table which varies its fields depending on a certain condition?

Thanks in advance!

Re: Create a table with different fields depending if their values match a condition

richgalloway — Fri, 21 Jan 2022 13:26:04 GMT

A table can have only one set of headings. You can combine two columns into one using coalesce. For example, this query will create a 3-column table with either deployment or secret in column3. The trick for the reader, however, is to determine which it is.

index=index host=host source=source ("not_found" OR "incorrect") | eval column3 = coalesce(deployment, secret) | rename column3 as "deployment or secret" | table time name "deployment or secret"

Re: Create a table with different fields depending if their values match a condition

somesoni2 — Fri, 21 Jan 2022 19:24:10 GMT

See if something like this works for you.

index=index host=host source=source ("not_found" OR "incorrect") | table time name deployment secret | eval metric=if(deployment="not found", "deployment", "secret") | eval val=if(deployment="not found", "not found", "incorrect") | table time name metric val | eval {metric}=val | fields - metric val