topic Re: Rename same field different things in Splunk Search

Rename same field different things

tb582 — Mon, 28 Sep 2020 11:38:30 GMT

I have a search using transaction and the startswith/endswith but I don't know how to call the Task_time field in the starts with of my transaction "Encode Time" and the Task_time field in the ends with "Transfer Time"?

Re: Rename same field different things

Stephen_Sorkin — Sun, 08 Apr 2012 00:12:16 GMT

You can use eval to achieve this, by evaluating those fields before the transaction. Suppose the initial event includes the word "Encode" and the final event contains the word "Transfer": For example:

... | eval Encode_Time=if(searchmatch("Encode"), Task_time, null())
| eval Transfer_time=if(searchmatch("Transfer",Task_time, null()
| transaction <uid>

Alternately, if the Encode event really starts the transaction and the Transfer event really ends it, you can just use eval after the transaction to pick the values of the Task_time multivalued field:

... | transaction <uid>
| eval Encode_time = mvindex(Task_time, 0)
| eval Transfer_time = mvindex(Task_time, -1)

Re: Rename same field different things

tb582 — Sun, 08 Apr 2012 03:30:21 GMT

hmm ok I think we are getting somewhere, but encode and transfer are not really events they are simply strings. I'm forcing them to be the first and last in the transaction by using the starts with/ends with parameters

Re: Rename same field different things

tb582 — Mon, 28 Sep 2020 11:38:35 GMT

Here's my search as it currently stands:

index=myindex sourcetype=box-app host=box04* OR host=box050 | transaction task_id startswith="SUCCESS : 100% : Encode completed" endswith="SUCCESS : 100% : (PUSH) completed" | eval starswith = mvindex(Task_time, 0) | rename Task_time AS " Encode" | eval endswith = mvindex(Task_time, -1) | rename Task_time AS "Copy Transfer" | fields " Encode" "Copy Transfer"

Re: Rename same field different things

Stephen_Sorkin — Sun, 08 Apr 2012 17:23:53 GMT

You should be able to search:

index=myindex sourcetype=box-app host=box04* OR host=box050 | transaction task_id startswith="SUCCESS : 100% : Encode completed" endswith="SUCCESS : 100% : (PUSH) completed" | eval Encode = mvindex(Task_time, 0) | eval "Copy Transfer" = mvindex(Task_time, -1) | table "Encode" "Copy Transfer"

Re: Rename same field different things

tb582 — Sun, 08 Apr 2012 19:50:37 GMT

doesent seem to work i get all the resutls within my start/end transaction. Not just the two above that I'm looking for. They all have
Task_time fields and I cant tell which ones are which if I cant rename them approprately.

Re: Rename same field different things

Stephen_Sorkin — Sun, 08 Apr 2012 19:54:24 GMT

If you want to exclude other events from the transaction, you can add to the search part before the first pipe: NOT ("SUCCESS : 100% : Encode completed" OR "SUCCESS : 100% : (PUSH) completed".

Are you saying that the "Encode" and "Copy Transfer" fields have more than one value each?

Re: Rename same field different things

tb582 — Mon, 28 Sep 2020 11:38:40 GMT

why would I add NOT if the encode and copy strings are exactly what I'm trying to get?

They each have one Task_time field per task_id

Re: Rename same field different things

Stephen_Sorkin — Sun, 08 Apr 2012 20:11:54 GMT

You're absolutely right. Take out the NOT.

Re: Rename same field different things

tb582 — Mon, 28 Sep 2020 11:38:43 GMT

hehe - ok finally that gets me down to the two lines per task_id that I'm looking for. Next is since both the encode and the copy line have a value for Task_time, how do I rename the enocde Task_time field as one thing and the copy as another?

Re: Rename same field different things

Stephen_Sorkin — Sun, 08 Apr 2012 20:26:07 GMT

Like in the original answer, you have two choices:

Pick out the fields before the transaction using eval Encode=if(searchmatch("Encode completed", Task_time, null()) and eval Transfer=if(searchmatch("PUSH completed", Task_time, null()). This will leave each transaction with one value for Encode, and one value for Transfer.
After the transaction, slice the multivalued "Task_time" field into two separate values using mvindex.

Re: Rename same field different things

tb582 — Mon, 28 Sep 2020 11:38:45 GMT

where do I stick this, which converts milaseconds to HH:MM:SS?

eval inSec = Task_time / 1000 | fieldformat Task_time = tostring(inSec, "duration")

Re: Rename same field different things

Stephen_Sorkin — Sun, 08 Apr 2012 21:05:35 GMT

You can put those at the very end, but you have to do it twice, once for each of the fields "Encode" and "Transfer", not for "Task_time". Also, you can combine the two. For instance, add: | fieldformat Encode = tostring(Encode/1000, "duration") | fieldformat Transfer = tostring(Transfer/1000, "duration")

Re: Rename same field different things

tb582 — Sun, 08 Apr 2012 22:55:36 GMT

keep getting "Error in 'fieldformat' command: Typechecking failed. '/' only takes numbers."