Splunk Search

fieldformat individually is a pain

NickJLange
Explorer

Related to my previous question on arbitrary lists of variables...

sum(CPU*) seems to pull off an interesting trick of
1.) enumerating all possible variables starting with CPU

Is there anyway to template their output name sum(CPU*) as CPU$BLAH$

which then leads to any way to do this en-masse for fieldformat?

right now I'm using excel to generate the field list... which is slightly complex and painful. Would love something simple/elegant...

0 Karma

sundareshr
Legend

You could try this

| stats sum(CPU*) AS CPU* | foreach CPU* [ eval <<FIELD>>= tostring(<<FIELD>>, "commas") ]
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...