topic Re: How to split event into multiple rows in a table? in Splunk Search

How to split event into multiple rows in a table?

mihenn — Tue, 29 Sep 2020 12:08:38 GMT

Hello everyone,

I'm trying to get an analysis of an process log file. The logfile contains an event for every ended process. This Event contains the following data:

Process ID, Starttime, Endtime, bytes_transferred

Now I want to build a timechart for bytes transferred. But I do not want to show the bytes at a single point of time when the process ended. The bytes_transferred should be split up to the interval, the process takes place.

I calculated the duration of the processes and the bytes_per_second of the processes. Now i want to write down a row for each second a process was running with the corresponding calculated timestamp (start_time+1, start_time+2, start_time+2,...., start_time+duration).

How can I do this with Splunk?

Thank you

Re: How to split event into multiple rows in a table?

Richfez — Mon, 19 Dec 2016 13:15:40 GMT

A few lines of sample data would help us immensely here. Both what you are starting with, and the data you have at the end of what you are doing. It would even help a bit if you could make a mock up version of what you want to see, too.

Thanks!
Rich

Re: How to split event into multiple rows in a table?

sundareshr — Mon, 19 Dec 2016 13:37:12 GMT

Try this

base search | eval event_range=mvrange(starttime, endtime, "1s") | mvexpand eventrange | table process_id event_range bytes_per_second

Re: How to split event into multiple rows in a table?

anand_singh17 — Mon, 29 May 2017 11:49:03 GMT

mvexpand 'field_name'

works!!