topic Re: How make a table with key and value columns and change a field's name? in Splunk Search

How make a table with key and value columns and change a field's name?

momori — Fri, 08 Aug 2014 23:30:30 GMT

The table we want to make looks something like this:

---------- key | value --------

someName | someValue

someName1 | someValue1

where someName is a field name and someValue is a value of the field we got from our log file.
We're not sure if there is a way to insert a someName text into the table to display. Is this possible?

Re: How make a table with key and value columns and change a field's name?

mataharry — Sat, 09 Aug 2014 00:20:28 GMT

if this is just a presentation request.
try

<mysearch> | stats values(myfield) by myotherfield

or it you already have your data , try to rotate it.
<mysearch> | table key value | transpose

http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/Transpose

Re: How make a table with key and value columns and change a field's name?

ppablo — Mon, 11 Aug 2014 17:57:57 GMT

Hi @momori

If someName is already a field name in your events from your search, you might find the rename command useful. Have you tried this option yet?

http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/Rename

Re: How make a table with key and value columns and change a field's name?

somesoni2 — Mon, 11 Aug 2014 18:21:46 GMT

If my understanding is correct, are you trying to get all the field names and corresponding value(s) from your log? If yes, you can use command called "fieldsummary" which will give you list of fields in your log. Check this out

http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Fieldsummary

Re: How make a table with key and value columns and change a field's name?

momori — Mon, 11 Aug 2014 20:42:52 GMT

transpose worked. thanks!

Re: How make a table with key and value columns and change a field's name?

momori — Mon, 11 Aug 2014 22:31:23 GMT

using rename in conjunction with the tranpose from the above answer worked well. Thank you for your help

Re: How make a table with key and value columns and change a field's name?

ppablo — Mon, 11 Aug 2014 22:35:56 GMT

No problem @momori 🙂 glad our combined responses helped solve your issue!

Patrick